Windows Firewall Registry Paths for Rules and States

This article details the exact Windows Registry locations used to store Windows Defender Firewall profile states and active firewall rules. By navigating the Windows Registry Editor (regedit), administrators can view, troubleshoot, or audit the operational states of Domain, Private, and Public profiles, as well as the complete set of inbound and outbound firewall rules.

Registry Path for Firewall Profile States

The overall state and behavior settings for each network profile (Domain, Private, and Public) are located under the following parent path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

Inside this key, you will find three distinct subkeys corresponding to each network profile:

• Domain Profile: ...\FirewallPolicy\DomainProfile
• Private Profile: ...\FirewallPolicy\StandardProfile
• Public Profile: ...\FirewallPolicy\PublicProfile

Key Values within Profile Subkeys:

• EnableFirewall (DWORD): Set to 1 when the firewall profile is turned on and 0 when disabled.
• DefaultInboundAction (DWORD): Controls the default action for incoming connections (1 to block, 0 to allow).
• DefaultOutboundAction (DWORD): Controls the default action for outgoing connections (0 to allow, 1 to block).
• DoNotAllowExceptions (DWORD): When set to 1, blocks all incoming connections, ignoring any allowed rule exceptions.

Registry Path for Firewall Rules

Active custom and system firewall rules are stored in a dedicated subkey under the same policy tree:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

Each value in this registry key represents an individual firewall rule. The value names are typically generated GUIDs or rule identifiers, and the value data is a formatted string containing all configuration parameters for that rule, including:

• v: Rule schema version (e.g., v2.30)
• Action: Allow or Block
• Active: TRUE or FALSE
• Dir: Direction (In for inbound, Out for outbound)
• Protocol: Protocol number (e.g., 6 for TCP, 17 for UDP)
• LPort / RPort: Local and Remote ports
• App: Path to the associated application binary
• Name: The display name of the firewall rule

Registry Path for Restricted Services Rules

Rules specifically tied to Windows services and modern store applications are maintained in separate subkeys:

• Static Service Rules: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System
• Configurable Service Rules: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System