Windows Firewall: Domain: Inbound connections
This DWORD value defines the default Windows Firewall action for inbound connections under the domain profile.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\DefaultInboundAction
This DWORD value defines the default Windows Firewall action for inbound connections under the domain profile. A value of 1 means Block: the firewall blocks inbound traffic for which no applicable inbound firewall rule allows the connection. This default action is considered after the firewall has evaluated its rules.
The setting therefore does not unconditionally block every inbound connection. Matching allow rules can still admit required traffic. It does not change outbound connections or the default actions of the private and public profiles.
Notes
Security
Default blocking reduces the device's attack surface on a domain network. An application or service does not become reachable from the network merely because it is listening for connections; inbound access requires an effective allow rule.
The value is not a substitute for specific firewall rules. The effective result for any connection still depends on the complete rule set and on how rules from the applicable policy stores are merged.
Possible side effects
Applications and services that require inbound connections are unreachable over the network unless an appropriate allow rule applies. Server features, shares, or remote-management functions can consequently stop working even while the relevant service continues to run locally.
Notes
The value uses the REG_DWORD type: 0 means Allow and 1 means Block. It affects only the domain profile and requires Windows Firewall to be enabled for that profile. If a connection is assigned the private or public profile, that profile's settings apply instead.
Microsoft documentation
Microsoft Learn: Firewall CSP – DefaultInboundAction for the domain profile
Microsoft Learn: Default Inbound Action registry value