Windows 10: Firewall rules resetting

For some reason I'm not able to keep my firewall settings saved. Specifically, apps that I allow through the firewall whether through prompt or control panel reset back to "not allowed.' I think this is happening after each update. It's extremely frustrating as I primarily use RDP to access the machine, and about 50% of the time I find it blocked by the firewall.

I've seen some threads suggesting the problem is antivirus/malware software, but I don't have any running on this machine. I don't use this machine for much, so there are very few apps installed and nothing very out of the ordinary. I'd appreciate any help!

:)

 

Problems with Internet Connection Sharing after 2017-11 Windows 10 Update [Temporary fix found]

I've now been brave enough to reset my firewall policy and it seems to have fixed the problem.

I did the reset with:

Control Panel->System and Security->Windows Firewall->Advanced Settings->Actions->Restore Default Policy

Before I did this I exported the current policy d (Actions->Export Policy...) so I could restore it if anything went wrong and I also exported the rules (Inbound Rules->Actions->Export List..., Oubound Rules->Actions->Export List ... and Monitoring->Firewall->Actions-Export
List...) so I had a record I could use as a basis for reinstalling rules if saw problems later.

I now have two .wfw files, one from before the policy reset (1.5 MB) and one from after (0.2 MB) and if I install the one I saved I can make the problem come back. So this is definitely the issue.

Other statistics:

Before the reset I had 1623 inbound firewall rules, 964 outbound firewall rules and 1440 monitoring rules, afterwards just 205, 144 and 48 respectively. Note that the latter counts are immediately after policy reset and before ICS had been re-established.
When ICS gets set up again the counts change.

There are a lot of duplicate rules, nearly all associated with Internet Connection Sharing. I had over 160 repeats of some ICS rules (although, interestingly one is repeated just 138 times). In contrast, after reset there's just one duplicated rule (one
AllJoyn rule in each of the three sets).

After deduplication, my pre-reset counts are 384, 346 and 201 respectively.

Since ICS is a service so is not associated with a user, I can strip out all rules that are associated with an individual user account (after reset there are none of these).

After deduplication and user rule stripping my counts are 297, 175 and 120 respectively.

 

Windows resets firewall rules after shutdown

Hi,

Thank you for the reply.

I suggest you to set the computer in a clean boot state and check if it helps.
Setting the system in a clean boot state will help to identify if any third party applications or startup items are causing the issue.

How to perform a clean boot in Windows


http://support.microsoft.com/kb/929135

Warning: After clean boot troubleshooting steps, refer to the section "How to reset the computer to start as usual after troubleshooting with clean boot" in the provided
link to return your computer to Normal startup mode.

Hope this information helps. Reply to the post with an updated status of the issue so that we can assist you further.

Thank you.

 

Nope, no antivirus. I'm not sure what you mean about sending. My problem is that the firewall prevents applications (remote desktop in particular) from accessing the machine.

 

Did you see this? Seems common problem and the "solution" is to backup/restore firewall rules after upgrades.

Windows Firewall rules reset to default after updating from 1511 to 1607

 

Ugh. I was afraid of hearing something like that. But it seems like that can't be right. How could anyone run win10 in an enterprise environment if they had to reconfigure the firewall every couple of days? Is everyone else just changing the settings with an automatic script?

 

It isn't every couple of days though - it is when you do an upgrade - from the 1511 version to 1607 for example. These version upgrades reset all sorts of stuff to defaults but are every 6 months or so and there isn't another this year.

Are you getting it more often? If you are then it must be a different issue.

I suppose, worst case, you could schedule a task to run netsh advfirewall import... every logon as a workaround. The command is described in the eightforums tutorial linked from that TechNet article.

 

Thanks, I will try that. Sounds like perhaps my problem isn't related to upgrade at all. I wonder if it's resetting on reboot. Might try some more investigations. Thanks for your help.

 

Best of luck with it - if you can find what is resetting it it would help.

There is quite a lot of malware that disables the firewall but malware resetting it to default seems odd. Nonetheless running a scan with Malwarebytes or something may be worth a shot.