PowerShell script to query ports on GPO

Question

Hi I need to query FW GPO ports within multiple remote servers. At the first step I build this query which should retrieve the information locally and I plan to add it as a .PS script inside ScriptBlock. I built a query that integrates results from two different queries. On the first query, I put the filters I need without any issues however on the second query I had issues.

This is the script:

Get-NetFirewallRule -Action Allow -Enabled True -Direction Inbound | Select-Object -Unique | Where-Object {$_.LocalPort -eq 7680}|
Format-Table -Property Profile,
Enabled,
Direction,
@{Name='Protocol';Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},
@{Name='LocalPort';Expression={($PSItem | Get-NetFirewallPortFilter).LocalPort}},
@{Name='RemotePort';Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}},
@{Name='RemoteAddress';Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}},
Profile

I have a couple of questions:

1. Can someone advise how to filter local ports and also a range of ports in this query? I tried many times without success (how do we use Where-Object to query such as that @{Name='Protocol';Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}})
2. Will use netsh instead will it be preferable?
3. How do we customize the results and present the results in AsBuiltReport framework?

Thanks Shai

I tried to modify the where-object with no success. It should bring back the rows where

Action=Allow,
Enabled=True 
Direction=Inbound
and
($_.LocalPort -match '80|135|139|445|5985|5986' -or $_.LocalPort -ge 49152 -or $_.LocalPort -le 65535)

Answer 1

It looks like you need to modify your Where-Object call to perform more fine-grained filtering, based on the expression you already have, with some corrections:

Get-NetFirewallRule -Action Allow -Enabled True -Direction Inbound | 
  Where-Object { 
    $portFilter = $PSItem | Get-NetFirewallPortFilter
    $portFilter.LocalPort -match '^(80|135|139|445|5985|5986)$' -or 
      ($portFilter.LocalPort -ge 49152 -and $portFilter.LocalPort -le 65535)
  } |
  Format-Table Profile,
               Enabled,
               Direction,
               @{ Name='Protocol'; Expression={ $portFilter.Protocol } },
               @{ Name='LocalPort'; Expression={ $portFilter.LocalPort } },
               @{ Name='RemotePort'; Expression={ $portFilter.RemotePort } },
               @{ Name='RemoteAddress'; Expression={ ($PSItem | Get-NetFirewallAddressFilter).RemoteAddress } }

Note:

• -match '80|135|139|445|5985|5986' was changed to -match '^(80|135|139|445|5985|5986)$' to ensure that port numbers only match in full, to rule out false positives.

• $_.LocalPort -ge 49152 -or $_.LocalPort -le 65535 was changed to ($portFilter.LocalPort -ge 49152 -and $portFilter.LocalPort -le 65535) (from -or to -and), as I presume you want to match ports between those two numbers.

• Since variable $portFilter is defined in the second Where-Object call, your Format-Table can then use $portFilter in lieu of $PSItem | Get-NetFirewallPortFilter in its calculated properties.

  • As an aside: In your original Format-Table call, you're repeating a ($PSItem | Get-NetFirewallPortFilter) call in each calculated property's expression, which is inefficient; even if you had no preexisting variable, you could assign the result to a variable in the first such property, and then use the variable in the remaining ones.

• As always, Format-* cmdlets should only ever be used to produce for-display output; if you need to programmatically process the output later, use Select-Object instead.

  • See this answer for more information.