How to Enable or Disable Windows Defender Firewall From Command Prompt

You need to enable or disable Windows Defender Firewall from Command Prompt, perhaps for a script or remote repair, and you’re hoping the command works without weakening the wrong network profile. Windows 10 and Windows 11 support the same netsh advfirewall commands.

Fix #1: Open Command Prompt as an administrator

Firewall changes require administrator privileges. Without them, commands may fail or leave the settings unchanged.

1. Press the Windows key and type cmd.
2. Select Run as administrator under Command Prompt.
3. Select Yes when User Account Control asks for permission.

You should see Administrator: Command Prompt in the title bar.

Fix #2: Check the firewall state

Windows Defender Firewall uses separate Domain, Private, and Public profiles. Checking all three prevents confusion when a laptop changes networks.

1. Enter this command:

netsh advfirewall show allprofiles

2. Find the State line under each profile.

Each profile should report ON or OFF. The output also shows its default inbound and outbound policies.

• Domain applies when the PC connects to an Active Directory domain.
• Private applies to trusted networks, such as your home router.
• Public applies to untrusted networks, including public Wi-Fi.

For shorter output, run:

netsh advfirewall show allprofiles state

You should see the state of all three profiles without the additional policy details.

Fix #3: Enable Windows Defender Firewall

Target every profile unless you have a specific reason to change only one. This keeps the firewall active when Windows switches network profiles.

1. Run this command:

netsh advfirewall set allprofiles state on

2. Wait for Command Prompt to display Ok..
3. Check the result:

netsh advfirewall show allprofiles state

Domain, Private, and Public should each report ON.

To enable only the active profile, run:

netsh advfirewall set currentprofile state on

To target one named profile, use the matching command:

netsh advfirewall set domainprofile state on
netsh advfirewall set privateprofile state on
netsh advfirewall set publicprofile state on

The selected profile should report ON when you check its state.

Fix #4: Disable Windows Defender Firewall temporarily

Disabling the firewall exposes the PC to unsolicited network traffic. Do this only for a short troubleshooting test, then turn it back on.

1. Disable every profile with:

netsh advfirewall set allprofiles state off

2. Confirm that Command Prompt displays Ok..
3. Perform the test that required the firewall to be disabled.
4. Re-enable it immediately:

netsh advfirewall set allprofiles state on

You should see Ok. after each state change.

To disable only the Private profile, use the original profile-specific command:

netsh advfirewall set privateprofile state off

The other valid targets are currentprofile, publicprofile, and domainprofile. I’d skip disabling allprofiles unless a profile-specific test can’t identify what’s blocking the connection.

If a program works only while the firewall is off, you’ve found the breakthrough: it needs a targeted rule. Leave the firewall enabled and add that rule instead.

Fix #5: Set the default inbound and outbound policy

A common baseline blocks unsolicited inbound traffic while allowing outbound connections. Apply it to the current profile with one command.

1. Run:

netsh advfirewall set currentprofile firewallpolicy blockinbound,allowoutbound

2. Confirm that Command Prompt displays Ok..
3. Check the current settings:

netsh advfirewall show currentprofile

The firewall policy should show blocked inbound connections and allowed outbound connections.

The stricter blockinboundalways setting also ignores allow rules. For example, this command blocks every inbound connection on Public networks:

netsh advfirewall set publicprofile firewallpolicy blockinboundalways,allowoutbound

Restore normal rule processing with:

netsh advfirewall set publicprofile firewallpolicy blockinbound,allowoutbound

Use blockinboundalways carefully. It can stop Remote Desktop, file sharing, and a VPN client even when their allow rules are enabled.

Fix #6: Open a port with a firewall rule

Open only the port and direction the application requires. Clear rule names make later troubleshooting much easier.

1. Check whether a similar rule already exists:

netsh advfirewall firewall show rule name=all

2. Add an inbound TCP rule for Remote Desktop port 3389:

netsh advfirewall firewall add rule name="Open Remote Desktop" protocol=TCP dir=in localport=3389 action=allow

3. Confirm that Command Prompt displays Ok..
4. Inspect the new rule:

netsh advfirewall firewall show rule name="Open Remote Desktop"

The output should show an enabled inbound allow rule for TCP port 3389.

Opening port 3389 doesn’t enable Remote Desktop itself. It only permits matching traffic through Windows Defender Firewall.

To allow inbound TCP port 8080 across all profiles, run:

netsh advfirewall firewall add rule name="Allow TCP 8080" dir=in action=allow protocol=TCP localport=8080 profile=any

To allow inbound UDP port 7365, run:

netsh advfirewall firewall add rule name="Open UDP 7365" dir=in action=allow protocol=UDP localport=7365

Each successful command should return Ok..

Fix #7: Open a range of ports

A single rule can cover a continuous port range. Confirm that the application genuinely needs the entire range before allowing it.

1. Run the original outbound UDP range command:

netsh advfirewall firewall add rule name="UDP ports" protocol=UDP dir=out localport=6000-7000 action=allow

2. Verify the rule:

netsh advfirewall firewall show rule name="UDP ports"

The output should list UDP ports 6000-7000 with an outbound allow action.

Fix #8: Allow a specific program

A program rule is often safer than opening a port for every application. Replace the example path with the executable’s full path.

1. Run:

netsh advfirewall firewall add rule name="My Program" dir=in action=allow program="C:\MyProgram.exe" enable=yes

2. Check the rule:

netsh advfirewall firewall show rule name="My Program"

The displayed program path should match the executable you entered. If the software is installed elsewhere, delete the incorrect rule and recreate it with the right path.

Fix #9: Review or delete firewall rules

Duplicate rules can leave you stuck because it’s hard to tell which one Windows is applying. Inspect existing entries before adding another copy through remote management software or a script.

1. Display every rule:

netsh advfirewall firewall show rule name=all

2. Display only enabled rules:

netsh advfirewall firewall show rule status=enabled name=all

3. Delete an unwanted rule by its name, protocol, and port:

netsh advfirewall firewall delete rule name="Open Port 3234" protocol=TCP localport=3234

A successful deletion should report the number of deleted rules. Check the spelling and filters if it reports that no rules match.

Fix #10: Use PowerShell for new scripts

PowerShell’s NetSecurity commands return structured objects, which makes them easier to filter and reuse in automation.

1. Press the Windows key and type PowerShell.
2. Select Run as administrator.
3. Enable every firewall profile:

Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True

4. Confirm the result:

Get-NetFirewallProfile | Select-Object Name, Enabled

Each profile should show True.

To disable all three profiles temporarily, run:

Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False

To restore the usual inbound and outbound defaults, run:

Set-NetFirewallProfile -Profile Domain,Private,Public `
  -DefaultInboundAction Block `
  -DefaultOutboundAction Allow

For domain fleets, use Group Policy. Microsoft Intune or another endpoint management service is a better fit for centrally managed cloud devices.

Fix #11: Reset firewall settings as a last resort

A reset removes custom firewall rules and restores default policy settings. Export or document required rules first because this action can’t selectively preserve them.

1. Open Command Prompt as an administrator.
2. Run:

netsh advfirewall reset

3. Wait for the Ok. response.
4. Check every profile:

netsh advfirewall show allprofiles

The profiles should show their default configuration. Recreate only the rules your applications require.

When the commands don’t work

Don’t use commands beginning with netsh firewall; that older context is superseded by netsh advfirewall. If an administrator command still can’t change a setting, Group Policy, Intune, or another management policy may be enforcing it. Contact the administrator before trying to override a managed configuration.

Conclusion

Fix #6 usually solves the real problem because a targeted rule keeps the firewall enabled while allowing the required traffic. Once the program finally connects, keep that narrow rule; repeated failures after a reset point to enforced policy, security software, or a damaged Windows installation.