This article describes how to check if Windows Firewall is enabled on all the LAN Connections on a server. I am going to make this post as short as possible but with all the required details…

  • What to do? Check if Windows Firewall is enabled on all LAN Connections
  • Where to get data from? WMI
  • What is the desired state? Firewall should be Enabled

I want to check if Windows Firewall is enabled on all of my LAN Connections. For this, I need to get a list of all the LAN Connections on my machine. After I get the list of all the connections on my machine, for each connection in the list, I need to go and check for the Windows Firewall status. So here, we will need to use nested data sources. I will show you how to!

 Create the first WMI data source as follows:

Name: EnumerateConnections

Namespace: root\Microsoft\HomeNet

WMI Class Name: HNet_Connection

 Create a Setting under the first data source as follows:

Property: __RELPATH

Substitution: ConnectionPath 

The above defined Data source / Setting pair will get you all the LAN Connections on your machine! If you see, there is a new property we populated in the Setting called Substitution. Substitution behaves like a place holder. In our scenario, I get a list of all the connections on my PC. After that, for each connection, I need to query another WMI class. While querying the second WMI class, I need to specify the Where Clause. Because I want to check if firewall is enabled for that particular connection. While specifying the Where Clause, I need an ID so that I can identify the connection. That id is the __RELPATH. By using Substitution variable, I am storing the value of the __RELPATH property for each connection in the Substitution variable. As simple as that!

Now, lets create a Nested data source within the previous data source. Why do we need to create a nested data source? Because, this is not an individual query. From the first data source / setting, I got a list of connections. Now for each connection, I need to get its properties from a different WMI Class. Here are the details of the second WMI Data source:

Name: FindConnectionProperties

Namespace: root\Microsoft\HomeNet

WMI Class Name: HNet_ConnectionProperties

Where Clause of WQL: Connection = '%ConnectionPath%' 

Note: While creating the Where Clause, type Connection=’ and then click Append Substitution button. A popup would come up and show you the ConnectionPath substitution variable that we saved earlier. Select the variable and click Add. It would get appended. Type a single quote again to mark the ending.
Let me explain you with an example:

Let’s say I have 2 connections on my server. Because of the first data source / setting pair, I have got a hold to both the connections.

 Lets say, the details are:

Connection1’s __ RELPATH: 1111 and Connection2’s __RELPATH: 2222

Now when I create the second nested WMI data source, the Where clause will automatically get converted to: Connection = '1111' for the first connection and Connection = '2222’ for the second connection! This happens automatically because of the substitution variable that we used. Basically the Substitution variable gets substituted!

Now create a Setting element under the second data source as follows:

Property: IsFirewalled

 Now create a rule under this Setting checking for the Firewall status as follows:

Name: CheckFirewalled

Type: Active

Rule Query: $. != 'True'

Event Description: Firewall is not enabled!

Event ID: 123

Severity: Error

 Let me know if you have any questions! Thanks.

Once u have created the complete manifest, it would like similar to the diagram below.