Windows Server 2025 / How to Review Defender and Windows Firewall Security

Basic Windows Server 2025 protection combines updates, separate administrative identities, malware protection, and restricted network access. Inspect current state, make only justified role-specific exceptions, and verify that both protection and required services remain operational.

Record the role and security baseline

Controllers, file servers, and web servers have different communication needs. Record roles, access routes, backups, and updates before changing a shared setting set.

• Separate everyday and administrator accounts.
• Limit remote administration to approved PCs and networks.
• Document each role’s required services and ports.
• Include protection updates and restore checks in routine maintenance.

A security baseline is a review starting point, not a reason to execute an unexplained registry bundle on every server. Check version support, operational effects, and recovery for each change.

Inspect Defender mode and currency

Use an elevated query and compare active or passive mode with the intended product arrangement. See Microsoft Defender Antivirus modes and behavior.

Get-MpComputerStatus | Select-Object AMRunningMode,AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated
Get-MpPreference | Select-Object ExclusionPath,ExclusionProcess,ExclusionExtension

Check engine and intelligence updates, providing a controlled supply route for isolated machines. A failed query requires checking installation, product state, and privileges; it does not prove complete protection. Keep exclusions minimal and justified by the role’s official guidance and measured need, rather than excluding a whole drive or all executables.

Inspect profiles and effective rules

Get-NetConnectionProfile
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction
Get-NetFirewallRule -PolicyStore ActiveStore | Where-Object Enabled -eq 'True' | Select-Object DisplayName,Direction,Action,Profile

Domain, Private, and Public profiles follow network recognition. If a domain server is not recognized as Domain, investigate DNS and domain connectivity rather than relabeling it to conceal the cause. Inspect effective local and GPO rules.

Windows Firewall guidance advises retaining protection. Check listener, protocol, port, source address, and profile separately. A narrower new allow rule does not override another broad allowance.

Create and remove one isolated test rule

For trusted FS1 and CLIENT1 on the isolated domain network, allow only ICMPv4 echo requests from the client. Confirm its current DHCP address at its console, then run on FS1 only if the rule name is unused:

$clientAddress = [ipaddress](Read-Host 'Current CLIENT1 IPv4 address')
New-NetFirewallRule -Name 'Lab-ICMPv4-From-Client' -DisplayName 'Lab ICMPv4 from CLIENT1' -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress $clientAddress -Profile Domain -Action Allow

From CLIENT1, test ping 172.24.50.20. This rule applies only to Domain; inspect the actual profile and any preexisting ICMP allowances before interpreting a difference. Review firewall command-line management.

Afterward remove only the rule you created:

Remove-NetFirewallRule -Name 'Lab-ICMPv4-From-Client'

Continued ping success may mean another allowance still exists. Do not delete all related rules merely to make the demonstration fail.

Verify protection alongside service health

After a change, verify authorized management access and the server’s actual role: domain authentication, DNS, file shares, or web responses. Record the test time and source address when correlating blocked traffic and security events.

For recovery, compare and reverse only the changed policy or exception. A service that works because protection was disabled is not a completed solution. Redesign the justified communication or process exception and retain console and backup access.