POS FIREWALL TOOLKIT - PERSISTENT EDITION
=========================================

IMPORTANT
---------
This toolkit can leave a Windows terminal without its host firewall. Use it only
on authorized, dedicated POS systems whose network is otherwise protected.
Creating application/port rules for the POS software is safer than disabling all
firewall profiles.

WHAT "KEEP-OFF MODE" DOES
-------------------------
The installer performs all of the following:

1. Disables Windows Firewall for Domain, Private, and Public profiles.
2. Writes the state to the local PersistentStore.
3. Sets local policy values for all three profiles to keep the firewall off.
4. Hides the Firewall and network protection area in Windows Security and
   suppresses firewall-related notifications. It does NOT hide antivirus,
   SmartScreen, account-protection, or unrelated Windows Security notifications.
5. Installs two Scheduled Tasks that run as the SYSTEM account:
      - At computer startup
      - Every 5 minutes
6. The tasks check the effective state and reapply the disabled state if another
   local process or user turns a profile on.
7. Saves the original affected policy values so they can be restored later.

WHAT IT DOES NOT DO
-------------------
- It does not stop or disable the Windows Firewall service (MpsSvc).
- It does not stop or disable Windows Security or Security Center services.
- Windows may still internally evaluate security health. The toolkit hides the
  firewall-specific user interface/notifications and enforces the local state.
- It cannot guarantee control over a domain Group Policy, Microsoft Intune/MDM,
  EDR/security product, or another administrator. Higher-priority management can
  override local policy or prevent the setting from changing.
- A script cannot silently bypass User Account Control. An administrator must
  approve the UAC prompt or enter administrator credentials.

MAIN FILES
----------
Install-Keep-Firewall-Off-Run-as-Administrator.cmd
    Recommended file for the requested persistent behavior. Double-click it and
    approve UAC. It installs keep-off mode and disables all profiles.

Enable-Firewall-and-Remove-Keep-Off-Run-as-Administrator.cmd
    Removes the tasks, restores the saved policy values, removes the enforcement
    script, and enables Domain, Private, and Public.

Remove-Keep-Firewall-Off-Only-Run-as-Administrator.cmd
    Removes the tasks and restores policy, but does not change the current
    firewall profile state.

Disable-Firewall-Once-Run-as-Administrator.cmd
    Disables all three profiles without installing keep-off mode.

Firewall-Control-Menu-Run-as-Administrator.cmd
    Administrator menu for all actions and status.

Check-Firewall-Status.cmd
    Shows ActiveStore, PersistentStore, policy values, and task status.

HOW TO USE
----------
1. Extract the entire ZIP to a normal local folder.
2. Keep every file in the same folder.
3. Double-click Install-Keep-Firewall-Off-Run-as-Administrator.cmd.
4. Approve the UAC prompt.
5. Review the result and then restart or sign out if the Windows Security UI has
   not refreshed yet.

TO RESTORE THE FIREWALL
-----------------------
Double-click:

Enable-Firewall-and-Remove-Keep-Off-Run-as-Administrator.cmd

This must be used instead of only turning the firewall on manually. Otherwise,
the installed keep-off tasks would disable it again.

FILES INSTALLED ON THE COMPUTER
-------------------------------
C:\ProgramData\POSFirewallToolkit\Enforce-POSFirewallDisabled.ps1
C:\ProgramData\POSFirewallToolkit\Keep-Off-Policy-Backup.json
C:\ProgramData\POSFirewallToolkit\Firewall-Toolkit.log

SCHEDULED TASKS
---------------
POS Firewall Toolkit - Keep Firewall Disabled at Startup
POS Firewall Toolkit - Keep Firewall Disabled Monitor

EXIT CODES
----------
0 = Success
1 = Error or elevation failure
2 = Verification or cleanup warning, commonly because a higher-priority policy
    is controlling the profile or the saved backup is unavailable

MANAGED DEVICES
---------------
For Active Directory, Entra/Intune, RMM, or EDR-managed terminals, configure the
approved central policy instead of fighting it with a local task. The status and
log output identify when the effective state is still being enforced elsewhere.
