Skip to content

Commit ae3b8c4

Browse files
MichaelGrafnetterMichaelGrafnetter
authored
Public draft (#1)
1 parent c76db11 commit ae3b8c4

File tree

78 files changed

+7921
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

78 files changed

+7921
-2
lines changed

‎.editorconfig‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
root = true
2+
3+
# Text files
4+
[*.md,*.yml,*.json,*.ps1,*.sh,*.lua]
5+
indent_style = space
6+
indent_size = 2
7+
insert_final_newline = true
8+
trim_trailing_whitespace = true

‎.github/README.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Active Directory Firewall
2+
3+
## Introduction
4+
5+
This project aims to provide production-ready and well-tested guidelines on configuring the Windows Firewall for Active Directory-related server roles.
6+
7+
![Windows Firewall with Advanced Security Screenshot](../Images/Screenshots/dc-firewall.png)
8+
9+
## Domain Controller Firewall
10+
11+
The following materials are currently available:
12+
13+
- 🛠️[Domain Controller Firewall Tool (DCFWTool)](https://github.com/MichaelGrafnetter/active-directory-firewall/releases/latest) (zipped distribution of the [source code](../ADDS/DCFWTool/))
14+
- 📄[Whitepaper](https://github.com/MichaelGrafnetter/active-directory-firewall/releases/latest) (PDF [generated](workflows/generate-whitepaper.yml) from the [ADDS/README.md](../ADDS/README.md) file)
15+
- 📜[Sample Firewall GPO HTML Report](../ADDS/GPOReport.html)
16+
- 📋[List of Built-In Firewall Rules](../ADDS/inbound-builtin-firewall-rules.csv)
17+
18+
## References
19+
20+
### Active Directory Domain Services
21+
22+
- 🌐[How to configure a firewall for Active Directory domains and trusts](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts)
23+
- 🌐[Service overview and network port requirements for Windows](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements)
24+
25+
### Active Directory Certificate Services
26+
27+
- 🌐[Firewall Rules for Active Directory Certificate Services](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/firewall-rules-for-active-directory-certificate-services/ba-p/1128612)
28+
29+
### Active Directory Federation Services
30+
31+
- 🌐[AD FS Required Ports and Protocols](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#ports-required)

‎.github/workflows/generate-whitepaper.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Generate Whitepaper
2+
3+
on:
4+
push:
5+
paths:
6+
- 'ADDS/README.md'
7+
- '.github/workflows/generate-whitepaper.yml'
8+
9+
jobs:
10+
generate:
11+
name: Generate
12+
runs-on: ubuntu-latest
13+
timeout-minutes: 10
14+
steps:
15+
- name: Checkout the repository
16+
uses: actions/checkout@v4
17+
18+
- name: Get the current date
19+
id: get_date
20+
run: echo "date=$(date '+%B %e, %Y')" > $GITHUB_OUTPUT
21+
22+
- name: Generate the whitepaper using Pandoc
23+
uses: docker://pandoc/extra
24+
with:
25+
args: >-
26+
--output=Domain_Controller_Firewall.pdf
27+
--from=markdown
28+
--to=pdf
29+
--pdf-engine=xelatex
30+
--shift-heading-level-by=-1
31+
--top-level-division=section
32+
--table-of-contents
33+
--toc-depth=2
34+
--number-sections
35+
--template=eisvogel
36+
--lua-filter=pandoc.lua
37+
--variable=lof:true
38+
--variable=classoption:oneside
39+
--variable=geometry:a4paper,margin=2cm
40+
--variable=colorlinks:true
41+
--variable=linkcolor:"[HTML]{4077C0}"
42+
--variable=titlepage:true
43+
--variable=titlepage-rule-color:de0000
44+
--variable=titlepage-rule-height:40
45+
--variable=header-includes:"\usepackage{sectsty} \sectionfont{\clearpage}"
46+
--variable=caption-justification:centering
47+
--variable=listings-disable-line-numbers:true
48+
--metadata date="${{ steps.get_date.outputs.date }}"
49+
--resource-path="ADDS:/.pandoc/templates"
50+
ADDS/README.md
51+
52+
- name: Publish the whitepaper as artifact
53+
uses: actions/upload-artifact@v4
54+
with:
55+
name: Whitepaper
56+
path: Domain_Controller_Firewall.pdf
57+
if-no-files-found: error

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
*.pdf
2+
*.docx

‎.vscode/extensions.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"recommendations": [
3+
"ms-vscode.PowerShell",
4+
"GitHub.vscode-pull-request-github",
5+
"GitHub.vscode-github-actions",
6+
"EditorConfig.EditorConfig",
7+
"DavidAnson.vscode-markdownlint",
8+
"bierner.markdown-preview-github-styles",
9+
"mechatroner.rainbow-csv",
10+
"GrapeCity.gc-excelviewer",
11+
"GitHub.copilot",
12+
"GitHub.copilot-chat"
13+
]
14+
}

‎ADCS/builtin-firewall-rules.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Direction,Name,Group,Protocol,Port,Program,Service,Remote Address,Notes

‎ADDS/ADMXSchema/BaseTypes.xsd‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<xs:schema id="ADMX" elementFormDefault="qualified" targetNamespace="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:pd="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" version="1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
3+
4+
<xs:simpleType name="GUID">
5+
<xs:annotation>
6+
<xs:documentation>A standard {12345678-1234-1234-1234-123456789abcd} style guid string.</xs:documentation>
7+
</xs:annotation>
8+
<xs:restriction base="xs:string">
9+
<xs:pattern value="\{[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}"/>
10+
</xs:restriction>
11+
</xs:simpleType>
12+
13+
<xs:simpleType name="versionString">
14+
<xs:restriction base="xs:token">
15+
<xs:pattern value="[0-9]{1,4}\.[0-9]{1,5}"/>
16+
</xs:restriction>
17+
</xs:simpleType>
18+
19+
<xs:simpleType name="stringReference">
20+
<xs:annotation>
21+
<xs:documentation>A reference to a localized string in the localized string section/table.</xs:documentation>
22+
</xs:annotation>
23+
<xs:restriction base="xs:string">
24+
<xs:pattern value="\$\(string\.(\p{L}|\p{N}|_)+\)"/>
25+
</xs:restriction>
26+
</xs:simpleType>
27+
28+
<xs:simpleType name="presentationReference">
29+
<xs:annotation>
30+
<xs:documentation>A reference to a policy presentation in the localized presentation section/table.</xs:documentation>
31+
</xs:annotation>
32+
<xs:restriction base="xs:string">
33+
<xs:pattern value="\$\(presentation\.(\p{L}|\p{N}|_)+\)"/>
34+
</xs:restriction>
35+
</xs:simpleType>
36+
37+
<xs:simpleType name="resourceID">
38+
<xs:annotation>
39+
<xs:documentation>A localized string id (used in the localized string section/table).</xs:documentation>
40+
</xs:annotation>
41+
<xs:restriction base="xs:string">
42+
<xs:pattern value="(\p{L}|\p{N}|_)+"/>
43+
</xs:restriction>
44+
</xs:simpleType>
45+
46+
<xs:complexType name="Annotation" mixed="true">
47+
<xs:sequence>
48+
<xs:any processContents="skip"/>
49+
</xs:sequence>
50+
<xs:attribute name="application" type="xs:string" use="required"/>
51+
</xs:complexType>
52+
53+
<xs:simpleType name="itemName">
54+
<xs:annotation>
55+
<xs:documentation>The base type for all defined type names, e.g. categories.</xs:documentation>
56+
</xs:annotation>
57+
<xs:restriction base="xs:string">
58+
<xs:pattern value="(\p{L}|\p{N}|_)+"/>
59+
</xs:restriction>
60+
</xs:simpleType>
61+
62+
<xs:simpleType name="itemReference">
63+
<xs:annotation>
64+
<xs:documentation>The base type for all references to defined types, e.g. categories.</xs:documentation>
65+
</xs:annotation>
66+
<xs:restriction base="xs:string">
67+
<xs:pattern value="((\p{L}|\p{N}|_)+)|((\p{L}|\p{N}|_)+:(\p{L}|\p{N}|_)+)"/>
68+
</xs:restriction>
69+
</xs:simpleType>
70+
71+
<xs:complexType name="LocalizedString">
72+
<xs:annotation>
73+
<xs:documentation>A localized string</xs:documentation>
74+
</xs:annotation>
75+
<xs:simpleContent>
76+
<xs:extension base="xs:string">
77+
<xs:attribute name="id" type="pd:resourceID" use="required"/>
78+
</xs:extension>
79+
</xs:simpleContent>
80+
</xs:complexType>
81+
82+
<xs:simpleType name="registryKey">
83+
<xs:annotation>
84+
<xs:documentation>A valid registry key path (without reference to local system or user hive).</xs:documentation>
85+
</xs:annotation>
86+
<xs:restriction base="xs:string"/>
87+
</xs:simpleType>
88+
89+
<xs:simpleType name="registryValueName">
90+
<xs:annotation>
91+
<xs:documentation>A valid registry value name.</xs:documentation>
92+
</xs:annotation>
93+
<xs:restriction base="xs:string"/>
94+
</xs:simpleType>
95+
96+
<xs:simpleType name="fileName">
97+
<xs:annotation>
98+
<xs:documentation>A valid file name (without a file path).</xs:documentation>
99+
</xs:annotation>
100+
<xs:restriction base="xs:string"/>
101+
</xs:simpleType>
102+
103+
104+
</xs:schema>

‎ADDS/ADMXSchema/PolicyDefinitionFiles.xsd‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<xs:schema id="ADMX" elementFormDefault="qualified" targetNamespace="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:pd="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" version="1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
3+
<xs:include schemaLocation="BaseTypes.xsd"/>
4+
<xs:include schemaLocation="PolicyDefinitions.xsd"/>
5+
6+
7+
<!--
8+
Localization tables
9+
-->
10+
<xs:complexType name="Localization">
11+
<xs:annotation>
12+
<xs:documentation>A table of referenced localized strings and policy presentations.</xs:documentation>
13+
</xs:annotation>
14+
<xs:sequence>
15+
<xs:element name="stringTable" minOccurs="0">
16+
<xs:complexType>
17+
<xs:sequence minOccurs="1" maxOccurs="unbounded">
18+
<xs:element name="string" type="pd:LocalizedString"/>
19+
</xs:sequence>
20+
</xs:complexType>
21+
</xs:element>
22+
<xs:element name="presentationTable" minOccurs="0">
23+
<xs:complexType>
24+
<xs:sequence minOccurs="1" maxOccurs="unbounded">
25+
<xs:element name="presentation" type="pd:PolicyPresentation"/>
26+
</xs:sequence>
27+
</xs:complexType>
28+
</xs:element>
29+
</xs:sequence>
30+
</xs:complexType>
31+
32+
<xs:complexType name="LocalizationTable">
33+
<xs:annotation>
34+
<xs:documentation>A table of localization tables, one per language</xs:documentation>
35+
</xs:annotation>
36+
<xs:sequence>
37+
<xs:element name="localization" type="pd:Localization" minOccurs="1" maxOccurs="unbounded"/>
38+
</xs:sequence>
39+
<xs:attribute name="fallbackCulture" type="xs:language" default="en-US"/>
40+
</xs:complexType>
41+
42+
43+
<!--
44+
Special types and groups
45+
-->
46+
<xs:complexType name="FileReference">
47+
<xs:attribute name="fileName" type="pd:fileName" use="required"/>
48+
</xs:complexType>
49+
50+
<xs:complexType name="PolicyList">
51+
<xs:sequence minOccurs="1" maxOccurs="unbounded">
52+
<xs:element name="policy" type="pd:PolicyDefinition"/>
53+
</xs:sequence>
54+
</xs:complexType>
55+
56+
<xs:complexType name="SupportedOnTable">
57+
<xs:sequence>
58+
<xs:element name="products" type="pd:SupportedProducts" minOccurs="0" maxOccurs="1"/>
59+
<xs:element name="definitions" type="pd:SupportedOnDefinitions" minOccurs="0" maxOccurs="1"/>
60+
</xs:sequence>
61+
</xs:complexType>
62+
63+
<xs:complexType name="CategoryList">
64+
<xs:sequence minOccurs="1" maxOccurs="unbounded">
65+
<xs:element name="category" type="pd:Category"/>
66+
</xs:sequence>
67+
</xs:complexType>
68+
69+
<xs:complexType name="PolicyNamespaceAssociation">
70+
<xs:attribute name="prefix" type="pd:itemName" use="required"/>
71+
<xs:attribute name="namespace" type="xs:anyURI" use="required"/>
72+
</xs:complexType>
73+
74+
<xs:complexType name="PolicyNamespaces">
75+
<xs:sequence>
76+
<xs:element name="target" type="pd:PolicyNamespaceAssociation"/>
77+
<xs:element name="using" type="pd:PolicyNamespaceAssociation" minOccurs="0" maxOccurs="unbounded"/>
78+
</xs:sequence>
79+
</xs:complexType>
80+
81+
<xs:complexType name="LocalizationResourceReference">
82+
<xs:attribute name="minRequiredRevision" type="pd:versionString" use="required"/>
83+
<xs:attribute name="fallbackCulture" type="xs:language" default="en-US"/>
84+
</xs:complexType>
85+
86+
<!--
87+
Policy Definition file types and base element
88+
-->
89+
<xs:complexType name="PolicyDefinitions">
90+
<xs:annotation>
91+
<xs:documentation>The base type for general ADMX files with satellite resource files, etc.</xs:documentation>
92+
</xs:annotation>
93+
<xs:sequence>
94+
<xs:element name="policyNamespaces" type="pd:PolicyNamespaces"/>
95+
<xs:element name="supersededAdm" type="pd:FileReference" minOccurs="0" maxOccurs="unbounded"/>
96+
<xs:element name="annotation" type="pd:Annotation" minOccurs="0" maxOccurs="unbounded"/>
97+
<xs:element name="resources" type="pd:LocalizationResourceReference"/>
98+
<xs:element name="supportedOn" type="pd:SupportedOnTable" minOccurs="0" maxOccurs="1"/>
99+
<xs:element name="categories" type="pd:CategoryList" minOccurs="0" maxOccurs="1"/>
100+
<xs:element name="policies" type="pd:PolicyList" minOccurs="0" maxOccurs="1"/>
101+
</xs:sequence>
102+
<xs:attribute name="revision" type="pd:versionString" use="required"/>
103+
<xs:attribute name="schemaVersion" type="pd:versionString" use="required"/>
104+
</xs:complexType>
105+
106+
<xs:complexType name="PolicyDefinitionResources">
107+
<xs:annotation>
108+
<xs:documentation>
109+
The base type for localized RES.ADMX files with a single language/culture per file.
110+
Localization files are always in the namespace of the associated PDX file and
111+
never reference definitions from other namespaces.
112+
</xs:documentation>
113+
</xs:annotation>
114+
<xs:sequence>
115+
<xs:element name="displayName" type="xs:string"/>
116+
<xs:element name="description" type="xs:string"/>
117+
<xs:element name="annotation" type="pd:Annotation" minOccurs="0" maxOccurs="unbounded"/>
118+
<xs:element name="resources" type="pd:Localization"/>
119+
</xs:sequence>
120+
<xs:attribute name="revision" type="pd:versionString" use="required"/>
121+
<xs:attribute name="schemaVersion" type="pd:versionString" use="required"/>
122+
</xs:complexType>
123+
124+
<!--
125+
Used in conjuction: one ADMX file for policy definitions and an ADML file per language.
126+
-->
127+
<xs:element name="policyDefinitions" type="pd:PolicyDefinitions"/>
128+
<xs:element name="policyDefinitionResources" type="pd:PolicyDefinitionResources"/>
129+
130+
</xs:schema>

0 commit comments

Comments
 (0)