Had Microsoft done the Internet Connection Firewall in the initial Windows XP this way—that is more aggressive, less troublesome for normal networking uses, and on by default—it would have prevented a lot of the damage caused by Blaster, Sasser, Slammer and some lesser attacks. Microsoft pointed out at the time that users who ran ICF were safe from those attacks, but that missed the point: Why would anyone run ICF when it interfered with the ability to do many normal networking operations?
Windows Firewall, as the new ICF is known, is a much better program. Ive been running it for months now, and it hasnt interfered with anything. In fact, Ive barely noticed it. You may already have realized that this is a clue to some of the problems with it.
It was important for Microsoft to build a firewall that didnt hassle users with a lot of messages that would redound to their beloved OEMs and Internet service providers as support calls. Unfortunately, to do that, they made a firewall thats very conservative about blocking potentially suspicious traffic.
For instance, with very few exceptions, Windows Firewall monitors and blocks no outbound traffic. Outbound monitoring is actually (mixing a couple metaphors here) like locking the henhouse after the fox is already in. A user who infects himself with MyDoom might be stopped from being part of a DDOS attack on www.microsoft.com by outbound monitoring. Windows Firewall doesnt do this (hows that for irony?).
There are still plenty of problems you might have with a default configuration of Windows Firewall. If you are running a game server of some kind or an uncommon chat program, you might need to accept incoming connections on a nonstandard port. For this, Windows Firewall lets you set a program and port "exception."