topic Re: FW Not Installed is the reason for security audit failure in Cloud Networking Platform

FW Not Installed is the reason for security audit failure

cmiarshvac — Thu, 28 Dec 2017 20:36:38 GMT

I have a Client Security Report run every week. In the Security Policy under the Desktop section, i have the Firewall Enabled option "checked". For all of my Windows 10 clients, the Windows Firewall is enabled. The security report shows that each W10 client fails for these reasons: "FW not Installed"; "FW not enabled". Does anyone know what is settings is being interrogated to confirm Firewall is Installed and Enabled on Windows 10 clients?

Re: FW Not Installed is the reason for security audit failure

BlakeRichardson — Tue, 09 Jan 2018 20:35:49 GMT

What AV are you using, some antivirus software disables windows firewall and run their own version.

Re: FW Not Installed is the reason for security audit failure

cmiarshvac — Tue, 09 Jan 2018 20:50:36 GMT

Hello Blake,

I am running Webroot. I asked them about their firewall interaction. Their response: "Webroot's firewall only covers outbound traffic as we utilize Windows Firewall to cover inbound traffic."

Re: FW Not Installed is the reason for security audit failure

rguthrie — Thu, 05 Jul 2018 16:16:51 GMT

Greetings~ was any resolution found for this issue? Currently, I have a baseline Windows 10 Client that does not have any 3rd party AV. Windows Defender and Windows Firewall are both enabled / running / updated.... but it is also failing due to "FW not installed, FW not enabled, AV not running".

Re: FW Not Installed is the reason for security audit failure

cmiarshvac — Fri, 06 Jul 2018 14:28:26 GMT

No resolution yet. If someone from Meraki could comment about what is being queried to confirm FW and AV being enabled we might be able to adjust settings to get a good report.

Re: FW Not Installed is the reason for security audit failure

rguthrie — Fri, 06 Jul 2018 14:38:14 GMT

Bonjour @cmiarshvac

I actually dealt with Meraki support yesterday over this issue. They had me run this command at a DOS prompt (it's the command that the agent used to check complaince)

WMIC /Namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get * /Format:List

That should listdisplayName=Windows Defender and productState=397568 (product state might vary... would have to confirm with Meraki)

If it doesn't list Windows Defender open a ticket with them... but if it does like mine did, they had me turn off the Defender on the system in question and turn it back on. What I did was disable all part of defender, waited a few minutes and rebooted. The reboot turns the Real Time Protection back on by default, and I manually turned on the other components. My system showed up secure and compliant within an hour!!

Re: FW Not Installed is the reason for security audit failure

cmiarshvac — Fri, 06 Jul 2018 15:01:39 GMT

Thanks for the follow up. I will give this a try.