Enable Microsoft Defender Firewall Blocked-App Alerts in Windows 10 and 11

Prerequisites and How Firewall Alerts Work​

Before enabling firewall notifications or creating application rules, confirm the following requirements and behavioral boundaries:

• Administrator privileges: Turning firewall notifications on or off, modifying network profile states, or allowing an app through the firewall requires a local Administrator account and approval at a User Account Control (UAC) prompt.
• Microsoft Defender Firewall must be the active firewall: If you have installed a third-party security suite that registers its own firewall provider, Windows Security hands off filtering and notification management to that third-party application.
• Inbound listening behavior only: In Windows 10 and Windows 11, Microsoft Defender Firewall allows outbound connections by default and blocks unsolicited inbound connections unless a matching rule exists. The built-in blocked-app prompt triggers specifically when an application attempts to open a port and listen for incoming connections for the first time without an existing inbound rule. It does not pop up when an application is blocked by an explicit custom outbound block rule.
• No restart required: Changes to notification settings, network profiles, and allowed application rules take effect immediately without restarting Windows.

Identify Your Active Network Profile First​

Windows maintains separate firewall policies and notification toggles for three distinct network profiles. Before changing notification settings or adding app exceptions, check which profile your network connection currently uses so you do not inadvertently open ports on an untrusted network:

• Domain network: Used when your PC is joined to an Active Directory domain and can authenticate to a domain controller.
• Private network: Used for trusted home or small-office networks where you want to allow local device discovery or file sharing.
• Public network: The default, most restrictive profile, designed for coffee shops, airports, hotels, or any network where other connected devices are untrusted.

To identify your active profile and verify that the firewall is enabled:

• Open the Start menu, type Windows Security, and open the Windows Security app. (You can also open Settings: in Windows 11, go to Privacy & security > Windows Security; in Windows 10, go to Update & Security > Windows Security.)
• Select Firewall & network protection in the left navigation pane or on the main dashboard.
• Look for the network profile label marked (active) next to Domain network, Private network, or Public network.
• Confirm that the status directly underneath the active profile says Microsoft Defender Firewall is on.

If your home Wi-Fi or Ethernet connection is mistakenly listed under Public network (active) and you need local network apps to communicate securely without opening rules on public Wi-Fi, change the network profile first:

• In Windows 11: Open Settings (Win + I), select Network & internet, click Wi-Fi or Ethernet, select your connected network's properties, and change Network profile type to Private network or Public.
• In Windows 10: Open Settings (Win + I), select Network & Internet, click Status, click Properties under your active connection, and select Private or Public under Network profile.

Turn On Blocked App Alerts in Windows Security​

The Windows Security app provides the primary interface for managing toast notifications and the interactive Windows Security Alert dialog when a new app requests network access.

• Open Windows Security and select Firewall & network protection.
• Scroll to the bottom of the Firewall & network protection page and click Firewall notification settings.
• Under the Notifications heading, click the Manage notifications link.
• Locate the Firewall & network protection notifications section at the bottom of the page.
• Toggle Notify me when Microsoft Defender Firewall blocks a new app to On. If prompted by User Account Control, click Yes.
• Once the main toggle is on, review the individual profile checkboxes directly beneath it:
• Check Domain firewall to receive alerts on corporate domain networks.
• Check Private firewall to receive alerts on trusted home or work networks.
• Check Public firewall to receive alerts when connected to public networks.
• Close the Windows Security window; your changes are saved automatically.

Ensure Windows System Notifications Allow Security Prompts​

If the firewall notification toggle is enabled inside Windows Security but Windows suppresses pop-ups at the operating system level, the alert banner may be hidden in the Action Center or Notification Center while the app silently fails to connect. Verify that Windows system notifications and Focus settings allow alerts through:

In Windows 11​

• Press Win + I to open Settings and select System > Notifications.
• Confirm the main Notifications toggle at the top is set to On.
• Click Focus (or check the Do not disturb toggle at the top of the Notifications page) and ensure Do not disturb is turned Off while testing your application.
• Scroll down the Notifications list and verify that Windows Security (or Security and Maintenance, if listed) is toggled On.

In Windows 10​

• Press Win + I to open Settings and select System > Notifications & actions.
• Confirm that Get notifications from apps and other senders is set to On.
• Click Focus assist in the left pane and select Off (or verify that full-screen automatic rules are not suppressing alerts while you launch games or apps).
• Return to Notifications & actions, scroll down to Get notifications from these senders, and confirm Windows Security is set to On.

Alternate Methods to Enable Firewall Alerts​

If the Windows Security app interface is unavailable, or if you prefer configuring the underlying firewall profile properties directly, use the classic Control Panel or PowerShell.

Method 1: Use the Classic Control Panel​

The classic Windows Defender Firewall applet modifies the per-profile inbound listening prompt directly in the local firewall policy.

• Press Win + R to open the Run dialog, type firewall.cpl, and press Enter.
• In the left pane of the Windows Defender Firewall window, click Change notification settings (or Turn Windows Defender Firewall on or off). If prompted by UAC, click Yes.
• Under Private network settings, ensure Turn on Windows Defender Firewall is selected, and check the box labeled Notify me when Windows Defender Firewall blocks a new app.
• Under Public network settings, ensure Turn on Windows Defender Firewall is selected, and check the box labeled Notify me when Windows Defender Firewall blocks a new app. (Do not check Block all incoming connections, including those in the list of allowed apps, as that setting overrides both allowed app rules and notification prompts.)
• If your PC is joined to a domain, verify the same checkbox under Domain network settings.
• Click OK to apply the settings.

Method 2: Enable Blocked App Notifications with PowerShell​

System administrators and advanced users can query and enable the inbound listening notification flag (NotifyOnListen) across all firewall profiles using the built-in NetSecurity PowerShell module.

• Right-click the Start button and select Terminal (Admin) in Windows 11, or Windows PowerShell (Admin) in Windows 10. Click Yes at the UAC prompt.
• Check the current notification status across all three profiles by running:
  Get-NetFirewallProfile | Select-Object Name, Enabled, NotifyOnListen
• To enable blocked-app notifications on the Domain, Private, and Public profiles simultaneously, run:
  Set-NetFirewallProfile -Profile Domain,Private,Public -NotifyOnListen True
• Re-run the Get-NetFirewallProfile command from step 2 and confirm that NotifyOnListen now displays True for every profile.

Verify That Blocked App Alerts Are Working​

You can confirm your configuration in two ways:

• Configuration check: Open an elevated PowerShell window and run Get-NetFirewallProfile | Select-Object Name, Enabled, NotifyOnListen. Each active profile should show Enabled as True and NotifyOnListen as True. Inside Windows Security > Firewall & network protection > Firewall notification settings > Manage notifications, the toggle and profile checkboxes should remain On after closing and reopening the app.
• Runtime behavior: Launch a network-capable application (such as a local development server, multiplayer game host, or media server) that has never been added to the firewall rule list. When the application binds to a network port to listen for incoming traffic, Windows displays a Windows Security Alert dialog titled Windows Defender Firewall has blocked some features of this app, displaying the app's name, publisher, and executable path, alongside checkboxes for Private networks and Public networks and an Allow access button.

Safely Allow a Trusted App Without Disabling the Firewall​

Warning: Never turn off Microsoft Defender Firewall globally or stop the Windows Defender Firewall service (MpsSvc) to fix a blocked application. Microsoft documentation notes that disabling the firewall exposes all listening ports on your PC, removes IPsec and Windows Service Hardening protections, and stopping MpsSvc is unsupported and can break the Start menu and Microsoft Store app updates. Always grant access only to the specific executable and only on the network profile it requires.

Click to expand...

If an app was already blocked silently before you turned notifications on, Windows may have already created an automatic Block rule for that executable when its initial prompt was dismissed or suppressed. Because a rule now exists for that program, Windows will not prompt you again the next time you open it. To allow a trusted app safely, add or update its entry in the Allowed apps list:

• Open Windows Security and go to Firewall & network protection.
• Click Allow an app through firewall (or press Win + R, type firewall.cpl, press Enter, and click Allow an app or feature through Windows Defender Firewall in the left pane).
• Click the Change settings button near the top-right corner of the Allowed apps and features list. Click Yes if prompted by UAC.
• Scroll through the alphabetical Allowed apps and features list to see if your application is already present:
• If the app is listed: Check the box to the left of the application's name, and then check the Private column on the right. Leave the Public column unchecked unless you specifically need the app to accept incoming connections while using untrusted public Wi-Fi.
• If the app is not listed: Click the Allow another app... button at the bottom right, click Browse..., navigate to the application's .exe file (for example, under C:\Program Files\), select it, click Open, and then click Add. Once it appears in the list, verify that Private is checked and Public is unchecked (unless required).
• Click OK at the bottom of the window to save your rule changes.

Troubleshooting and Rollback​

The Notification Toggle Immediately Switches Back to Off or Is Grayed Out​

• Cause: Group Policy, an organization MDM profile, or registry policy keys are overriding local user settings, or a third-party firewall is managing network protection.
• Fix: Open an elevated Command Prompt or PowerShell window and check whether policy registry values are forcing notifications off by querying:
  Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile","HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile","HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile" -ErrorAction SilentlyContinue
  Also inspect the standard profile keys where DisableNotifications is stored:
  Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile","HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile","HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" -Name DisableNotifications -ErrorAction SilentlyContinue
  If DisableNotifications is set to 1 under Policies\Microsoft\WindowsFirewall on a personal (non-domain) PC, open the Local Group Policy Editor (gpedit.msc on Windows Pro, Enterprise, and Education editions), navigate to Computer Configuration > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security, right-click Windows Defender Firewall with Advanced Security, select Properties, click Customize... under Settings on each profile tab, and set Display a notification to Not configured or Yes.

An App Is Still Blocked Without Showing a Pop-Up Alert​

• Cause 1: An explicit inbound Block rule already exists. When the Windows Security Alert dialog appears the first time an app runs and a user clicks Cancel (or closes the window without administrator approval), Windows Defender Firewall automatically creates inbound block rules for that executable (typically one for TCP and one for UDP). Once a rule exists for that executable path, the firewall no longer considers it a "new app" and silently drops future inbound connections without prompting again.
• Fix 1: Press Win + R, type wf.msc, and press Enter to open Windows Defender Firewall with Advanced Security. Select Inbound Rules in the left pane. Sort by the Name column, locate the entries for your application (marked with a red circle icon indicating a Block action), right-click each rule, and select Properties to change the action to Allow the connection???or select Delete so Windows treats the app as new and prompts you again the next time it listens on a port.
• Cause 2: "Block all incoming connections" is enabled on the active profile. If Block all incoming connections, including those in the list of allowed apps (known as ShieldsUp mode) is checked in firewall.cpl, Windows blocks all unsolicited inbound traffic and suppresses all new-app notification prompts.
• Fix 2: Open firewall.cpl, click Turn Windows Defender Firewall on or off, and clear the checkbox for Block all incoming connections, including those in the list of allowed apps under your active profile.

Rollback: Remove an Allowed App or Restore Firewall Defaults​

If you allowed an application by mistake or need to return Microsoft Defender Firewall to its clean factory configuration:

• To revoke a single app's access: Open firewall.cpl, click Allow an app or feature through Windows Defender Firewall, click Change settings, uncheck the box next to the application (or select the custom application and click Remove), and click OK.
• To silence blocked app notifications again: Open Windows Security > Firewall & network protection > Firewall notification settings > Manage notifications, and toggle Notify me when Microsoft Defender Firewall blocks a new app to Off, or run Set-NetFirewallProfile -Profile Domain,Private,Public -NotifyOnListen False in an elevated PowerShell window.
• To reset all firewall rules and notification settings to factory defaults:

Warning: Resetting the firewall deletes all custom inbound and outbound rules you or your installed applications have created. Some third-party apps or games may prompt for firewall access again the next time you launch them.

Click to expand...

• Open Windows Security and select Firewall & network protection.
• Click Restore firewalls to default near the bottom of the window.
• Click the Restore defaults button, click Yes at the UAC prompt, and click Yes in the confirmation dialog to restore default rules and notification settings.