Windows Defender Firewall’s basic on/off toggle covers most home users, but the Advanced Security console exposes genuinely granular rule creation worth knowing for anyone managing a shared or exposed machine.
# Block outbound traffic for a specific program New-NetFirewallRule -DisplayName "Block App X Outbound" <code> -Direction Outbound -Program "C:\Apps\suspicious.exe" -Action Block # Allow inbound traffic on a specific port, restricted to a local subnet New-NetFirewallRule -DisplayName "Allow RDP from LAN only" </code> -Direction Inbound -Protocol TCP -LocalPort 3389 ` -RemoteAddress 192.168.1.0/24 -Action Allow # List all active custom rules Get-NetFirewallRule -PolicyStore ActiveStore | Where-Object Enabled -eq True # Check the current profile's default behavior Get-NetFirewallProfile
Profiles Matter
Windows applies different rules depending on whether a network is classified Domain, Private, or Public — a common mistake is configuring a rule that only applies to the Private profile, then wondering why it doesn’t apply on a coffee shop’s Public network. Always specify -Profile explicitly if a rule needs to apply everywhere.