Windows – How to prevent Windows Update from re-enabling firewall rules

windows 10windows firewallwindows update

Regularly some Windows Update packages silently re-enable firewall rules, both Inbound and Outbound, is there a way to disable a rule for good or to remove from Windows Update the right to alter firewall rules?

(deleting rules does no good, Windows Update will recreate them)

Exemple of "frivolous" rules that keep re-enabling themselves: Windows Reading List, MSN Sports, Solitaire Collection, Get Office etc.

This is for a Windows 10 machine on a semi-public network, and AllJoyn, cast servers or various XBox ports are never ever going to be anything but security liabilities.

Best Answer

TL;DR: It's not possible to stop programs with Administrator access from changing firewall rules. Windows Firewall Control is a program that will automatically delete or disable Windows Firewall rules that you didn't approve by using the Secure Rules functionality.

The problem is that any program that runs with Administrator privileges is allowed to silently change Windows Firewall rules. Windows Update is joined by Firefox, Chrome and many others that feel entitled to ensure that they can send and receive network traffic without asking your permission.

The best solution I've found has been to use Windows Firewall Control (WFC) which has been acquired by Malwarebytes as of 2018. While there are a number of other products that provide a better interface on top of the Windows Firewall, this is the only one I've found that solves the problem you raise. It has functionality that it calls "Secure Rules" which will automatically disable any rules that were not created by the specific authorized groups. I have it so just Windows Firewall Control is allowed to create rules. According to the user guide, the way it works is for Windows Firewall Control to be notified when new rules are created and it will disable them if they're not in the right group.

Here's what the configuration looks like

When Chrome is updated, it tries to add a rule. The rule is created but automatically disabled but WFC. When an update of Chrome tries to add a rule, it's created but automatically disabled

A few other notes:

  • WFC is free but not open source. I personally would be happy to pay for it (as I have done to try a number of competing products) but hopefully it'll continue to be developed
  • I personally really like how it prompts me when a new program tries to access the network for the first time, but I can imagine that this would be as annoying as for any similar product. It's got the necessary learning mode, but you'd need to have some level of networking knowledge to get set up
  • As it sits on top of Windows Firewall, it's possible to verify that it will block itself from accessing the Internet, which is what you'd want
  • I've never noticed any performance issues
Related Question