Can't add a valid rule to win 11 firewall

General Checks & Solutions:​

1. Rule Configuration Validation:
   • Carefully inspect the rule you are attempting to create. Ensure all fields—such as the program path, IP ranges, ports, or protocols—are correctly defined.
   • Try creating a simple rule (e.g., blocking or allowing all traffic for a specific app, like notepad.exe) to see if it applies.
2. Firewall Profile Mismatch:
   • Verify if your firewall is active on the correct profile (Domain, Private, or Public). You can check this via Control Panel > Windows Defender Firewall > Settings.
   • Ensure the rule you create is being applied to the relevant profile marked as "active."
3. Administrative Permissions:
   • Confirm that you are creating these rules with administrative rights. If not, launch the Windows Defender Firewall tool as an admin (wf.msc).
4. Firewall Service Integrity:
   • Reset the firewall settings to their defaults and try again:
     
     Code:

     bash
          netsh advfirewall reset

     Run this command in an elevated Command Prompt or PowerShell. Be aware that it will clear all custom rules, so back up your existing rules if needed.
5. Corrupted Firewall Configuration:
   • If the rules seem to be added but don't function properly, the firewall's internal configuration may be corrupted. Use the sfc (System File Checker) tool to repair potential issues:
     
     Code:

     bash
          sfc /scannow

6. Windows Defender Firewall Advanced Security (GPO):
   • If your systems are part of an Active Directory (AD) domain, ensure no Group Policy Object (GPO) is overwriting your configuration. Certain domain policies can cause one or more settings to revert or prevent modifications.

Testing with Diagnostic Commands:​

• View active rules:
  
  Code:

  bash
    netsh advfirewall firewall show rule name=all

  Look for your custom rule in the output to confirm it's listed.
• Firewall events can be logged in the Event Viewer:
  1. Open Event Viewer.
  2. Navigate to Applications and Services Log > Microsoft > Windows > Security-Auditing.
  3. Look for warnings or errors relating to firewall configuration.

• What kind of rules you are adding (e.g., specific program, port-based rule, etc.).
• Any observations on why the rule (when set) is flagged differently or doesn't work.

1. Advanced Firewall Rule Debugging​

• When you create the outbound rule for notepad.exe, ensure you're doing the following:
  1. Open Windows Defender Firewall with Advanced Security (wf.msc).
  2. Go to Outbound Rules and select New Rule on the right-hand panel.
  3. Under Rule Type, select Program.
  4. Provide the exact path to the Notepad executable: C:\Windows\System32\notepad.exe.
  5. Select Block the connection, apply to all profiles (Domain, Private, Public), and finish the rule setup.
• After creating the rule, test its functionality by running Notepad and attempting to reach web resources (if possible).

2. Check Firewall Policies​

• Run the following commands in an elevated Command Prompt:
  
  Code:

  bash
       netsh advfirewall show allprofiles

  Review the output to verify:
  • State: ON
  • Default outbound behavior: ALLOW (this changes per the rule).
  If this looks fine, then there could still be a hidden Group Policy (or registry) issue overriding the settings.

3. Verify Registry Settings for Firewall​

1. Open Registry Editor (regedit) as an administrator.
2. Navigate to:
   
   Code:

         HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

3. Check the sub-folders FirewallRules or RestrictedServices and ensure they align with the rules you are setting. If anything looks suspicious (e.g., corrupted data, incomplete rules), consider deleting or backing it up before resetting.
   If unsure about what you’re looking at, take a backup of this branch:
   • Right-click FirewallPolicy, select Export, and save a .reg file.

4. Testing Firewall Core Functionality​

• Reset Firewall Completely:
  
  Code:

  bash
       netsh advfirewall reset

• Rebuild Windows Firewall rules using PowerShell:
  
  Code:

  powershell
       New-NetFirewallRule -DisplayName "Test Rule" -Direction Outbound -Program "C:\Windows\System32\Notepad.exe" -Action Block -Profile Any

  Check if this adds the new rule and displays it correctly.
  If even scripted rule creation fails, there may be issues with the firewall binaries themselves.

5. Audit the Event Viewer​

1. Open Event Viewer (eventvwr).
2. Navigate to:
   
   Code:

         Applications and Services Logs > Microsoft > Windows > Windows Firewall with Advanced Security

3. Look for entries related to errors or warnings while creating or enforcing outbound rules.
   Share any specific error codes or messages you find, as they can reveal what's going wrong behind the scenes.

6. Ultimate "Sledgehammer" Fix: Reinstall Firewall Service​

• Run this command to stop the service and reset its configuration:
  
  Code:

  bash
       sc stop mpssvc
       sc config mpssvc start=auto

• Attempt to restart the service:
  
  Code:

  bash
       sc start mpssvc

• If the service won't start or still misbehaves, use DISM to fix any corrupted system components:
  
  Code:

  bash
       dism /online /cleanup-image /restorehealth
       sfc /scannow

7. External Culprit Check​

• Any third-party VPN or networking applications?
• Any outdated system monitoring or device drivers?

Additional Steps:​

1. Firewall Logging​

• Enable logging for the current profile:
• Open Windows Security > Firewall & network protection > Advanced Settings.
• Right-click on the active profile (e.g., Domain profile) under Monitoring, then select Properties.
• Enable Log dropped packets and Log successful connections.
• Set Log file size (e.g., 4MB for sufficient logging).
• Note the log file location: Usually at C:\Windows\System32\LogFiles\Firewall\pfirewall.log.
• Recreate your outbound rule for notepad.exe, and then check the log file for matching entries. Look for any discrepancies or signs that your rule isn’t being enforced.

2. Narrow Down the Issue: Outbound Traffic Validation​

• Try blocking all outbound connections temporarily:
• Go to Advanced Security > Windows Defender Firewall with Advanced Security.
• Under the Outbound Rules, create a new rule for all programs:
• Type: Program
• Settings: Block all outbound traffic.
• Apply to all profiles.
• Test internet access for regular apps like a browser or Notepad (if relevant). This confirms if blanket rules are enforced.
• If this applies successfully, the issue could be rule-specific.
• If this still fails, there’s likely something interrupting the firewall engine or rule processing.

3. Firewall Group Policy Settings (Local or Domain)​

• Open the Group Policy Editor:
• Run gpedit.msc.
• Navigate to:
  
  Code:

     Computer Configuration > Administrative Templates > Network > Network Connections > Windows Defender Firewall

• Look for the following settings:
• Prohibit Unicast Response to Multicast or Broadcast Requests
• Allow inbound or outbound rules
  Any restrictions here could interfere with custom rules.
• If no unusual settings are present, confirm local policies by running:
  
  Code:

  powershell
     gpresult /h gp_report.html

  Open the generated HTML file for a summary of applied policies. Check for any firewall-related settings under Computer Configuration.

4. Service Dependencies​

• Make sure the following services are running:
• Windows Firewall (MpsSvc)
• Base Filtering Engine (BFE)
• IPsec Policy Agent (PolicyAgent)
• To check services:
  
  Code:

  bash
    services.msc

• Ensure the Startup Type is set to Automatic for these services. Restart them manually if necessary.

5. Registry Cleanup for Firewall Rules​

• Open the Registry Editor:
  
  Code:

  cmd
     regedit

• Navigate to:
  
  Code:

     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

• Delete stagnant rules under FirewallRules or RestrictedServices, or export and reset them by recreating the rules.

6. Testing Outside Windows Firewall UI​

New-NetFirewallRule -DisplayName "Block Notepad Test" -Program "C:\Windows\System32\notepad.exe" -Action Block -Direction Outbound -Profile Any

• After creating the rule, confirm it's listed:
  
  Code:

  Get-NetFirewallRule -DisplayName "Block Notepad Test"

• Additionally, test enforcement by launching Notepad and checking for behavior consistency.

7. Analyze Core Firewall Functionality​

• Run DISM and SFC as a safeguard:
  
  Code:

  cmd
    dism /online /cleanup-image /restorehealth
    sfc /scannow

8. Check for Windows Bugs​

• Check Windows Update history and ensure your device hasn’t skipped any cumulative updates.
• Review the patch notes for any known issues related to Firewall:
• Look at Microsoft's official changelogs for the latest version of Windows 11.
• If feasible, try uninstalling the most recent cumulative update to test whether the issue resolves.

If Problems Persist​

• Firewall logs.
• Behavior of global outbound rules for all programs.
• Results from PowerShell commands or any Event Viewer errors.

Steps to Fix Windows Update Error​

1. Run the Windows Update Troubleshooter
   • Open Settings > Update & Security > Troubleshoot.
   • Click on Additional troubleshooters > Select Windows Update > Run the troubleshooter.
   • Follow the on-screen instructions and let it try to resolve the problem.
2. Reset Windows Update Components
   Sometimes, corrupted update components can cause both update issues and strange behaviors in firewall dependencies. Use the following steps to reset them:
   Open Command Prompt as Administrator, and execute these commands one by one:
   
   Code:

   cmd
      net stop wuauserv
      net stop cryptSvc
      net stop bits
      net stop msiserver
      ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
      ren C:\Windows\System32\catroot2 catroot2.old
      net start wuauserv
      net start cryptSvc
      net start bits
      net start msiserver

   After running these commands, restart your system and retry both Windows Update and creating a new firewall rule.
3. Check Event Viewer for Update Errors
   • Open Event Viewer (eventvwr.msc).
   • Go to Windows Logs > System or Applications.
   • Look for error IDs related to Windows Update (common ones include 0x80073712, 0x80070005, or similar).
   • Share any error codes or descriptions you find, as they’ll help us narrow down the underlying issue.
4. Run DISM and SFC
   Since we know something isn’t right with Windows Update, running repairs using the DISM and SFC tools is critical. These commands repair system files and components:
   
   Code:

   cmd
      dism /online /cleanup-image /restorehealth
      sfc /scannow

5. Manually Install Missing Updates
   If Windows Update is stuck but you can identify the problematic cumulative update, try manually downloading it from the Microsoft Update Catalog.
   • Identify the needed update: Go to Settings > Update & Security > View Update History.
   • Search for the KB number in the Microsoft Update Catalog, download the standalone installer, and install it manually.

Additional Checks if Firewall and Update Are Linked​

1. Update Error Blocking Services
   A corrupted Windows Firewall configuration or other related services might be interfering with updates. Confirm these services are running:
   • Background Intelligent Transfer Service (BITS) (bits).
   • Windows Update Service (wuauserv).
   • Cryptographic Services (cryptSvc).
   • Windows Firewall Service (mpssvc).
   Check in the Services manager (services.msc):
   • Ensure they are all set to Automatic and running.
   • Restart each service if necessary.
2. Corrupt Update Affecting Firewall
   A partial or broken update could corrupt aspects of Windows, including the firewall. If cleaning up the update components doesn’t work, you may need to reset Windows Update and Firewall settings via:
   • Reset Firewall Rules to Default:
     
     Code:

     cmd
          netsh advfirewall reset

   • Reinstall Update Packages per earlier instructions.

Next Steps​

1. What happens when you attempt to fix the Windows Update issue.
2. Any Event Viewer logs for Windows Update or even Firewall-specific errors.
3. Results from SFC or DISM (e.g., if repairs are successful or errors persist).