To check Windows Firewall status, open Windows Security and select Firewall & network protection. Each profile (Domain, Private, Public) says whether the firewall is on, and the one you're using is marked active. netsh and PowerShell give the same answer in one line.
To check Windows Firewall status on Windows 11 or 10, open the Windows Security app and select Firewall & network protection. You'll see three network profiles, Domain, Private and Public, each saying "Firewall is on" or "Firewall is off", with your current network marked (active). For a one-line answer, run netsh advfirewall show allprofiles state in Command Prompt, or Get-NetFirewallProfile | Select-Object Name, Enabled in PowerShell. The profile that matters most is the active one.
The quick check is easy. The confusing part comes afterwards: the firewall shows "on" but an app still can't connect, or it says another program is in charge, or PowerShell reports settings as "NotConfigured". This guide covers all of that, plus how to turn the firewall back on without breaking anything. It belongs to my Windows security guides series, alongside checks for antivirus, encryption and sign-ins.
In this guide:
This is the method Microsoft recommends for most people, and it doesn't need administrator rights just to look.
A green tick means that profile is on. A red cross with a Turn on button means it's off. Microsoft's guide to firewall and network protection in Windows Security describes every option on this page, including Restore firewalls to default.
If the page names another company's product instead, a third-party firewall is in charge. There's a section on that below.
The older Control Panel page is still there in Windows 11 and gives a simple colour-coded view.
firewall.cpl and press Enter.From the left-hand menu you can also open Allow an app or feature through Windows Defender Firewall and Advanced settings. Advanced settings opens wf.msc, the full console with every rule. Microsoft's overview of Windows Firewall tools explains how Windows Security, Control Panel, wf.msc and the command-line tools all read the same underlying settings, so they should always agree.
If Control Panel and Windows Security seem to disagree, the usual reason is that you're looking at different profiles. Check which one is active in each.
Windows doesn't have one firewall setting. It has three profiles, and it applies one based on the network you're connected to.
| Profile | When Windows uses it | How strict it should be |
|---|---|---|
| Domain | A work PC connected to its organisation's Active Directory network | Usually managed by your IT team |
| Private | Networks you've marked as trusted, such as your home Wi-Fi | On, with sharing allowed only if you need it |
| Public | Cafés, hotels, airports, and any new network by default | On, and the strictest of the three |
Home PCs that aren't joined to a company domain will never use the Domain profile, so don't worry if it looks unused. What matters is that the active profile is on.
To see which profile each connection uses, run this in PowerShell:
Get-NetConnectionProfile | Select-Object Name, InterfaceAlias, NetworkCategoryThe NetworkCategory column shows Public, Private or DomainAuthenticated. Microsoft's Get-NetConnectionProfile reference covers the other properties. To change a network's type, go to Settings > Network & internet, open your Wi-Fi or Ethernet connection, and choose Public or Private. Pick Public if you're unsure; it's the safer choice.
netsh works in any Command Prompt and doesn't need administrator rights to read the status. It's ideal for a quick check or for pasting into a help request.
netsh advfirewall show allprofiles state for a simple ON or OFF per profile.netsh advfirewall show currentprofile to see only the profile in use right now.state (netsh advfirewall show allprofiles) for the full settings.The detailed version looks like this for each profile:
Public Profile Settings:
----------------------------------------------------------------------
State ON
Firewall Policy BlockInbound,AllowOutbound
LocalFirewallRules N/A (GPO-store only)
LocalConSecRules N/A (GPO-store only)
InboundUserNotification Enable
RemoteManagement Disable
UnicastResponseToMulticast Enable
Logging:
LogAllowedConnections Disable
LogDroppedConnections Disable
FileName %systemroot%\system32\LogFiles\Firewall\pfirewall.log
MaxFileSize 4096| Line | Healthy value | What it means |
|---|---|---|
| State | ON | The firewall is filtering traffic for this profile |
| Firewall Policy | BlockInbound,AllowOutbound | Unsolicited incoming connections are blocked unless a rule allows them; outgoing traffic is allowed |
| InboundUserNotification | Enable | Windows tells you when it blocks a new app |
| LogDroppedConnections | Disable (default) | Whether blocked traffic is written to the log file |
Microsoft's netsh advfirewall reference lists the other subcommands, including netsh advfirewall firewall show rule name=all for every rule.
PowerShell gives you the same answer as objects you can filter. Open PowerShell or Terminal and run:
Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundActionEnabled should read True for each profile. Here's the catch that confuses many people: the inbound and outbound columns often say NotConfigured. That doesn't mean the firewall is broken. By default the cmdlet reads the saved local settings, and NotConfigured means "use the Windows default", which is block inbound and allow outbound.
To see the settings Windows is actually enforcing, including anything pushed by Group Policy or your organisation's device management, ask for the active store:
Get-NetFirewallProfile -PolicyStore ActiveStore |
Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction, LogBlockedFor a script that simply warns you when something's off:
Get-NetFirewallProfile -PolicyStore ActiveStore |
Where-Object { -not $_.Enabled } |
ForEach-Object { "Firewall is OFF for the $($_.Name) profile" }No output means every profile is on. The Get-NetFirewallProfile documentation lists every property, from notification settings to log file paths.
Some security suites switch off Windows Firewall and use their own. That's normal and safe, as long as the replacement is running. Windows Security makes it obvious: the Firewall & network protection page shows the other product's name and says it's turned on, and each profile shows that the other product is in charge.
To confirm from PowerShell, ask Windows Security Center which firewall products have registered with it:
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName FirewallProduct |
Select-Object displayName, productStateIf nothing comes back, no third-party firewall has registered and Windows Firewall should be the one protecting you. If a product is listed that you've since uninstalled, its leftover registration may be what's keeping Windows Firewall off. Reinstall it and use the vendor's removal tool, or reset the firewall as shown below.
Also check that the firewall service itself is running:
Get-Service mpssvc | Select-Object Name, DisplayName, Status, StartTypeYou want Running and Automatic. Microsoft doesn't support stopping this service, even when you use another firewall, so if it's stopped or disabled, something has interfered with it. Antivirus is often replaced at the same time, so it's worth running my check for whether Windows Defender is on as well.
If an app can't connect, the firewall is the first thing people blame. Here's how to see whether it's actually being blocked.
In PowerShell you can list the rules that mention an app by name:
Get-NetFirewallRule -DisplayName "*Zoom*" |
Format-Table DisplayName, Enabled, Direction, Action, ProfileOr find every rule for a specific program file:
Get-NetFirewallApplicationFilter -Program "C:\Program Files\Example\app.exe" | Get-NetFirewallRuleAllowing an app is much safer than opening a port, because the app's ports only open while it's running. Microsoft's article on the risks of allowing apps through the firewall makes the same point and advises never allowing an app you don't recognise. Remember that the firewall blocks incoming connections by default, not outgoing ones, so most "can't connect" problems with ordinary apps aren't caused by it.
If the active profile is off and you're not using a third-party firewall, turn it back on. This won't break normal browsing, email or streaming.
netsh advfirewall show allprofiles state again to confirm every profile says ON.From an elevated Command Prompt, one command does all three profiles:
netsh advfirewall set allprofiles state onThe PowerShell equivalent, also run as administrator, is:
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled TrueBoth need an elevated window, and you'll see the familiar consent prompt first. If you've ever wondered why that prompt appears, my explainer on what UAC is in Windows covers it.
If settings are greyed out with "Some settings are managed by your organization", a policy controls the firewall. On a work device, talk to IT. On a personal PC, that message can be a sign that malware or a leftover tool changed policy, which is worth investigating.
When the rules themselves are a mess, Restore firewalls to default on the same page (or netsh advfirewall reset) puts everything back to factory settings. It removes rules apps have added, so some programs will ask for permission again.
Windows Firewall doesn't log traffic by default. Turning logging on is useful when you want proof that something is being blocked, or to see who's knocking.
Set-NetFirewallProfile -Profile Domain,Private,Public -LogBlocked True
Get-NetFirewallProfile -PolicyStore ActiveStore | Format-Table Name, LogBlocked, LogFileName, LogMaxSizeKilobytesThe default file is %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log, and its default maximum size is 4 MB. When it fills up, the oldest entries are dropped. You can also log allowed connections with -LogAllowed True, but that fills the file much faster.
Microsoft's guide to configuring Windows Firewall logging suggests separate log files for each profile on managed devices. On a home PC, one file is fine. Rule changes are recorded separately in Event Viewer under Applications and Services Logs > Microsoft > Windows > Windows Firewall With Advanced Security > Firewall, which is handy if a rule appeared that you didn't add.
Turn logging off again with -LogBlocked False when you've finished.
A firewall that says "on" is a good start, but it helps to know what that actually buys you.
The best follow-up check is to see what's actually listening on your PC, because every listening port is something the firewall rules have to handle. My guide on how to check open ports shows how to list them with netstat and PowerShell and tie each one to a program.
If the status isn't what you expected, or won't change, start here.
| Problem | Likely cause | What to try |
|---|---|---|
| Turn on button does nothing | Firewall service stopped, or a policy is blocking changes | Check Get-Service mpssvc, restart the PC, then try Restore firewalls to default |
| "Managed by your organization" | Group Policy or device management controls the firewall | Ask IT on a work PC; investigate on a personal one |
| Firewall keeps turning off | Security suite, "optimiser" tool or malware | Check SecurityCenter2 for registered products and run a full Defender scan |
| Home network shows as Public | Windows treats new networks as Public | Switch it to Private in Settings only if you trust the network |
| PowerShell says NotConfigured | Reading the local store, not the active one | Add -PolicyStore ActiveStore |
| App works on home Wi-Fi but not at a café | Allowed for Private, not Public | Leave it that way unless the app really needs incoming connections |
Your router has its own firewall too, which protects every device in the house. If you've confirmed Windows Firewall is fine, it's worth giving the router the same attention with my guide to securing your home Wi-Fi router.
Open Command Prompt and run netsh advfirewall show allprofiles state. It lists the Domain, Private and Public profiles with a State of ON or OFF for each. Reading the status doesn't need administrator rights; changing it does.
All three should normally be on. The one that matters right now is the active profile, which Windows Security labels (active). On a home PC that isn't joined to a work domain, that will be Private or Public.
It is if nothing else is protecting you, because services on your PC become reachable by other devices on the network, including strangers on public Wi-Fi. If a third-party security suite is managing the firewall instead, Windows Security will name it, and that's fine.
By default the cmdlet reads the saved local settings, where NotConfigured means Windows uses its built-in default: block inbound, allow outbound. Add -PolicyStore ActiveStore to see the settings that are actually being enforced.
Not by default. Each profile blocks unsolicited inbound connections and allows outbound ones. You can create outbound block rules in wf.msc, but most home users don't need to.
Yes. Windows Security, Control Panel, netsh and the PowerShell firewall cmdlets are all included in Windows 11 Home, and the steps are the same as on Pro.
No. Ordinary browsing, email, streaming and gaming work with the firewall on, because it allows outgoing connections and their replies. If a specific app stops receiving connections, allow that app rather than turning the firewall off.
Last checked: 24 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.
Check open ports with netstat -ano or Get-NetTCPConnection on Windows, sudo lsof -iTCP -sTCP:LISTEN -n -P on a Mac, and sudo ss -tulpn on Linux. Then match each port to its program and close or firewall anything you don't need.
To check BitLocker status, search Start for Manage BitLocker, or run manage-bde -status in an admin Command Prompt. Look at Protection Status: Protection On means your drive is really protected. Fully Encrypted with Protection Off means it isn't, yet.
Step-by-step Windows security guides: check Defender, startup programs, failed logins, open ports, UAC, encryption, passwords and 2FA. Plain English, free tools.
Check if Microsoft Defender Antivirus is on, up to date and not in passive mode. Windows Security steps, Get-MpComputerStatus fields, tamper protection and fixes.