Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically I've set my Windows firewall the way I want it, but apparently any application can create it's own rule to completely override my settings. How can I prevent this from happening?

share|improve this question
You can't, but it shouldn't be a major problem, because only applications that are running with elevated privileges can change the firewall rules. – Harry Johnston Aug 29 '12 at 2:41
up vote 4 down vote accepted

Yes but the computer will not allow any local exceptions not set by group policy.

I am going to assume you are not on a domain but if you are it is very similar it will just be a domain policy instead of a local policy.

First you must open the local group policy settings by opening mmc going to File->Add/Remove Snap-In... and adding the Group Policy Object Editor for your local computer.

From there navagate to Computer Configuration\Administrative Templates\Network\Network Connections\Windows Firewall\Standard Profile\ and there are two settings you want to set to disabled, Windows Firewall: Allow local port exceptions and Windows Firewall: Allow local program exceptions.

Once those are set you can no longer make any changes to the windows firewall using the Windows API, including going in by hand and editing it via advanced settings. If you want to enable a exception you will need to do it through the group policy now. You can set the rules up in Computer Configuration\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - Local Group Policy Object. These rules will be the only rules in affect on your system.

If you are on a domain you just need to use the domain group policy tools instead of the local ones.

share|improve this answer

Step by step instruction to block the applications from changing the firewall settings:

  1. Open Control Panel in the Start menu.

  2. Open Windows Firewall in the Control Panel. enter image description here

    Note: If Windows Firewall is not available, change View by to Large icons at the top right of the Control Panel.

  3. Select Allow a program or feature through Windows Firewall in the left column of the window. enter image description here

  4. Click the Change settings button in the Allowed Programs window. enter image description here
  5. Uncheck the program or feature and then click OK to save the changes. enter image description here

What if the program I want to block using the Windows 7 firewall is not listed?

  1. Follow the steps above.
  2. When you get to the last step (above) click the Allow another program button.
  3. Select the program from the Add a Program list or click Browse to find it and then click Add. enter image description here

  4. Uncheck the program and then click OK to save the settings. enter image description here


share|improve this answer
I'm really sorry to see that you have put time and effort in your answer, but this is not what I asked. I use advanced settings to set my own policy, but any application can apparently change the policy through Windows API (or some such) and I want to disallow any application changing MY firewall policy. – Branko Aug 28 '12 at 20:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .