Windows Advanced Firewall Programmatic Access

I finally got around to creating and account here as two of my daily drivers are now Windows 11. So yay me :)

As a developer I know that we can create Windows Firewall rules, exceptions and so on programmatically. From the perspective of convenience having a program create the rule for you is I suppose great, but from a malicious perspective I don't like that any program can add or modify my rules as they want to suit themselves.

I wanted to know if there is a way to "disable" programmatic access to the Windows Firewall basically making it so that unless you create the rule yourself through the GUI or command line, they cannot be created automatically programmatically. I have searched for this and the only thing you get back is how to disable the firewall which is not what I need.

Before the customary deluge of why don't you use a third party firewall and having all kinds of suggestion to use Comodo or other things thrown as a response, please save it. I already use that, this is a particular use case and I am not interested in "another program" as a solution, just a native way within Windows, policy, registry or whatnot, to disable the programmatic access. I am hoping for the community's insights.

Thanks in advance.

I don't believe there's a GPO policy to lock out Firewall rule changes.

The best answer is to export your current (and verified) ruleset to .vfw, and import them back as a Group Policy. Because it's now treated as policy, you can use "gpupdate /force" to revert any changes. Using the MPSSVC event logs, it's possible to track recent changes to Firewall that were made outside of the Group Policy.

garlin said:

I don't believe there's a GPO policy to lock out Firewall rule changes.

The best answer is to export your current (and verified) ruleset to .vfw, and import them back as a Group Policy. Because it's now treated as policy, you can use "gpupdate /force" to revert any changes. Using the MPSSVC event logs, it's possible to track recent changes to Firewall that were made outside of the Group Policy.

Audit MPSSVC Rule-Level Policy Change - Windows 10

Audit MPSSVC Rule-Level Policy Change determines if audit events are generated when policy rules are altered for the Microsoft Protection Service (MPSSVC.exe).

learn.microsoft.com

Click to expand...

It is certainly disappointing but thank you for the alternative option. At least gives me something to work out. I always wished there was a way to create the rules and assign them to groups so they can be disabled and enabled en mass but with script on load to ensure the rules are always exactly what we want but seems despite showing the group in the GUI there is actually no option to set it, but that's a different issue. Thank you again.

Someone shared the idea of adding a group name tag in front of every rule's name, to better identify them. Then you could use regular expressions to process them.

garlin said:

Someone shared the idea of adding a group name tag in front of every rule's name, to better identify them. Then you could use regular expressions to process them.

Click to expand...

Aha, clever. Currently we tag them [Application_Name] for sorting and identification; but thinking your RegEx idea can grab this existing piece of data, nice. Thank you.

Welcome binary or should I say 011000111000111 !!

elbmek said:

Welcome binary or should I say 011000111000111 !!

Click to expand...

Thank you. Lurked for a long time on the Ten Forum before registering. Here I was hoping credentials would transfer, didn't, so took me a bit to sign up here, but glad to be here.