diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md index b1b37ca008..61084f5184 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md @@ -53,19 +53,14 @@ netsh advfirewall set allprofiles logging filename %SystemRoot%\System32\LogFile ### Disable Windows Firewall -Microsoft recommends that you don't disable Windows Firewall because you lose other benefits provided by the service, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, [Windows Service Hardening](https://go.microsoft.com/fwlink/?linkid=104976), and [boot time filters](https://blogs.technet.microsoft.com/networking/2009/03/24/stopping-the-windows-authenticating-firewall-service-and-the-boot-time-policy/). -Disabling Windows Firewall can also cause problems, including: +Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose. +If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including: - Start menu can stop working - Modern applications can fail to install or update - Activation of Windows via phone fails - Application or OS incompatibilities that depend on Windows Firewall -Microsoft recommends disabling Windows Firewall only when installing a non-Microsoft firewall, and resetting Windows Firewall back to defaults when the non-Microsoft software is disabled or removed. -If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the **Services** snap-in, the display name is Windows Firewall and the service name is MpsSvc). -Stopping the Windows Firewall service isn't supported by Microsoft. -Non-Microsoft firewall software can programmatically disable only the parts of Windows Firewall that need to be disabled for compatibility. -You shouldn't disable the firewall yourself for this purpose. The proper method to disable the Windows Firewall is to disable the Windows Firewall Profiles and leave the service running. Use the following procedure to turn off the firewall, or disable the Group Policy setting **Computer Configuration|Administrative Templates|Network|Network Connections|Windows Firewall|Domain Prolfile|Windows Firewall:Protect all network connections**. For more information, see [Windows Firewall deployment guide](windows-firewall-with-advanced-security-deployment-guide.md). @@ -569,3 +564,6 @@ netsh advfirewall firewall add rule name="Inbound Secure Bypass Rule" dir=in sec ``` --- +[BTF]: /windows/win32/fwp/basic-operation +[MFWC]: /windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line +[FWRC]: /windows/win32/api/icftypes/ne-icftypes-net_fw_rule_category diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index b8e9d793fc..f6540ef8df 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -11,7 +11,7 @@ This article contains examples how to configure Windows Firewall rules using the ## Access the Windows Firewall with Advanced Security console -If you're configuring devices joined to an Active Directory domain, to complete these procedures you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the domain. To access the *Windows Firewall with Advanced Security* console, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security**. +If you're configuring devices joined to an Active Directory domain, to complete these procedures you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the domain. To access the *Windows Firewall with Advanced Security* console, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security**. Pay attention to the [Group policy processing considerations][GPPC] when using Group Policy. If you are configuring a single device, you must have administrative rights on the device. In which case, to access the *Windows Firewall with Advanced Security* console, select START, type `wf.msc`, and press ENTER. @@ -176,3 +176,5 @@ Using the two rules configured as described in this topic helps to protect your 1. On the **Action** page, select **Allow the connection**, and then select **Next** 1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** 1. On the **Name** page, type a name and description for your rule, and then select **Finish** + +[GPPC]: /windows/security/operating-system-security/network-security/windows-firewall/tools#group-policy-processing-considerations \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 8952b535cf..4de85b91d4 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -73,6 +73,18 @@ The *public network* profile is designed with higher security in mind for public > [!TIP] > Use the PowerShell cmdlet `Get-NetConnectionProfile` to retrieve the active network category (`NetworkCategory`). Use the PowerShell cmdlet `Set-NetConnectionProfile` to switch the category between *private* and *public*. +## Disable Windows Firewall + +Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose. +If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including: + +- Start menu can stop working +- Modern applications can fail to install or update +- Activation of Windows via phone fails +- Application or OS incompatibilities that depend on Windows Firewall + +The proper method to disable the Windows Firewall is to disable the Windows Firewall Profiles and leave the service running. See [Manage Windows Firewall with the command line][MFWC] for detailed steps. + ## Next steps > [!div class="nextstepaction"] @@ -89,3 +101,6 @@ To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WI [FHUB]: feedback-hub:?tabid=2&newFeedback=true [NLA]: /windows/win32/winsock/network-location-awareness-service-provider-nla--2 [CSP-1]: /windows/client-management/mdm/policy-csp-networklistmanager +[BTF]: /windows/win32/fwp/basic-operation +[MFWC]: /windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line +[FWRC]: /windows/win32/api/icftypes/ne-icftypes-net_fw_rule_category