How to Block an App From the Internet in Windows 10

Which tool you use depends on what you want to stop. A desktop program (an .exe file) is cut off by an outbound Block rule for that file in Windows Defender Firewall with Advanced Security, which you open by running wf.msc. The app still opens and works offline; it just can’t reach the internet. Microsoft Store apps need a package rule instead, and if all you want is less background data, a metered connection may be enough.

Pick the tool for the app you want to stop

What you want	Use	Notes
Keep a desktop program (game, editor, utility) offline	Outbound firewall rule on its .exe	The main method below; works on every Windows 10 edition
Block several programs, or the same program on many PCs	PowerShell or netsh command	Same rule, scripted
Keep a Microsoft Store app offline	Firewall rule tied to the app package	A path rule doesn’t fit Store apps
Just cut background downloads and updates	Metered connection	Limits data use; it isn’t a block
Stop a child using certain apps at all	Microsoft Family Safety on the child’s account	Controls the app, not its connection
Stop websites rather than an app	Website blocking	See how to block websites on Windows 10

Two blunt options are best avoided. Turning off the firewall removes protection for everything (Microsoft recommends keeping Windows Firewall on), and disabling the network adapter takes the whole PC offline. If you need local network access with no internet at all, see how to disable the internet without disabling the LAN in Windows 10.

Windows 10 reached end of support on October 14, 2025; PCs in the Extended Security Updates program get security fixes until October 12, 2027, per Microsoft’s end-of-support notice. The firewall steps are the same either way.

Find the exact file that goes online

A firewall rule blocks one file, so the most common reason a block “doesn’t work” is that it was placed on the wrong file. Many programs launch through one .exe and connect through another, such as a launcher, a helper or an updater.

1. From the shortcut: right-click the app’s Start menu or desktop shortcut and choose Open file location. If that opens a folder of shortcuts, right-click the shortcut there and choose Open file location again. Note the .exe that’s highlighted.
2. From Task Manager: with the app running, open Task Manager, go to the Details tab, right-click the app’s process and choose Open file location. If you’re unsure how to open it, see how to open Task Manager on Windows 10.
3. From netstat: while the app is doing something online, open Command Prompt as administrator and run netstat -b. It lists each connection with the executable that owns it. It can take a while, and it fails without enough permissions. netstat -ano is faster and shows a process ID (PID) you can match on Task Manager’s Details tab.

A worked example: a photo editor is installed at C:\Program Files\ExampleEditor\editor.exe, but netstat -b shows the connections belong to updater.exe in the same folder. You’d block both files, one rule each, so the editor never phones home.

Build the block rule in the firewall console

You need to be signed in with an administrator account.

1. Select Start, type wf.msc and press Enter. Windows Defender Firewall with Advanced Security opens. (You can also reach it from Control Panel’s Windows Defender Firewall page by selecting Advanced settings.)
2. In the left pane, select Outbound Rules.
3. In the Action pane on the right, select New Rule.
4. Choose Program as the rule type and select Next. Microsoft’s own steps use Custom, which leads to the same Program page with more pages after it; either works.
5. Select This program path, select Browse and pick the .exe you found. Check the path box afterward: if it now starts with something like %ProgramFiles% or %USERPROFILE%, replace it with the full path, such as C:\Program Files\ExampleEditor\editor.exe. If a rule ever seems not to match, the full path is the first thing to rule out. Select Next.
6. If you chose Custom, leave Protocol and Ports at their defaults (all ports) and Scope at any IP address, selecting Next each time.
7. On the Action page, choose Block the connection and select Next.

8. On the Profile page, leave Domain, Private and Public all checked unless you only want the block on certain networks. Public is the profile Windows uses for networks it doesn’t recognize, so unchecking it can leave a gap on café or hotel Wi-Fi.
9. Give the rule a name you’ll recognize later, such as “Block ExampleEditor,” and select Finish.

The rule takes effect right away. By default, Windows Firewall allows all outbound traffic unless a rule blocks it, which is why the rule has to be outbound. Inbound connections are already blocked unless something allows them, so an extra inbound rule is optional and rarely needed for this job. Microsoft’s Windows Firewall configuration page walks through the same wizard.

Make the same rule from PowerShell or Command Prompt

A command is quicker for several files and easy to reuse. Open PowerShell as administrator (right-click Start and choose Windows PowerShell (Admin)) and run:

New-NetFirewallRule -DisplayName "Block ExampleEditor" -Direction Outbound -Program "C:\Program Files\ExampleEditor\editor.exe" -Action Block

-Direction Outbound matters: without it the rule is created as inbound, the default. The profile defaults to Any, which covers all three networks. Microsoft lists every option on the New-NetFirewallRule page. For the updater in the earlier example, run the line again with a new display name and the updater’s path.

In Command Prompt (as administrator), the older netsh tool does the same:

netsh advfirewall firewall add rule name="Block ExampleEditor" dir=out action=block program="C:\Program Files\ExampleEditor\editor.exe"

Microsoft’s netsh reference shows name, dir=out and action=block, but not every option. If the command rejects a parameter, run netsh advfirewall firewall add rule ? to see the syntax your PC accepts.

Prove the block holds

Don’t rely on the app simply looking quiet. Check in three ways, from quickest to most certain:

1. Use the app. Try whatever needs the internet: sign-in, sync, an update check. Expect a connection error or an offline message.
2. Look for connections. Run netstat -b again as administrator while the app tries to connect. The blocked .exe shouldn’t appear with an established connection.
3. Read the firewall log. Turn on logging of dropped packets with netsh advfirewall set allprofiles logging droppedconnections enable (if that wording is rejected, netsh advfirewall set allprofiles logging ? shows the options). Dropped attempts are then written to %windir%\system32\logfiles\firewall\pfirewall.log. Entries marked DROP from the app’s attempts confirm the rule is working. Turn logging off afterward with the same command ending in disable.

Microsoft explains the log file and its settings on the firewall logging page.

Pause, restore or delete the rule

• Pause: in wf.msc, select Outbound Rules, right-click your rule and choose Disable Rule. Choose Enable Rule to block again.
• Remove: right-click the rule and choose Delete.
• Allow some local traffic: open the rule’s properties and use the Scope tab to limit which remote IP addresses the rule covers, for example so the block applies to everything except a printer or file server on your network.
• PowerShell: Disable-NetFirewallRule -DisplayName "Block ExampleEditor" pauses it, Enable-NetFirewallRule with the same name turns it back on, and Remove-NetFirewallRule -DisplayName "Block ExampleEditor" deletes it.
• Command Prompt: netsh advfirewall firewall delete rule name="Block ExampleEditor".

Be careful with the PowerShell pause command: run Disable-NetFirewallRule with no name and it disables every firewall rule on the PC, not just yours. Always include -DisplayName. Adding -WhatIf to Remove-NetFirewallRule shows what would be deleted without deleting it.

Store apps and background data

Microsoft Store apps are packaged, and a rule pointed at a file path doesn’t fit them well. New-NetFirewallRule has a -Package parameter that ties a rule to a Store app’s package security identifier (SID), but finding that identifier takes extra work that Microsoft’s page doesn’t walk through, so for most people the simpler options below are more practical.

• Metered connection: go to Settings > Network & Internet > Wi-Fi, select your connected network, and turn on Set as metered connection (Ethernet has a similar one). Windows then limits background data: Windows Update downloads only priority updates, and Store app downloads may pause. It reduces traffic; it doesn’t block any app. Microsoft explains the details on its metered connections page.
• Background apps: Windows 10 has a Background apps list under Settings > Privacy where you can stop a Store app running when you aren’t using it.
• A child’s account: Microsoft Family Safety can limit or block apps on a family member’s account, which is often what parents actually need.

When the app still reaches the internet

Work through these in order:

1. A second file is connecting. Run netstat -b and block every executable the app uses: launcher, updater, crash reporter, or a runtime such as a Java process.
2. The path doesn’t match. Open the rule’s properties, check the Programs and Services tab, and replace any %ProgramFiles% style path with the full path. If an update moved the app to a new folder, edit the path or make a new rule.
3. The profile is unchecked. On the rule’s Advanced tab, make sure the profile of your current network is included.
4. Another firewall is in charge. Some third-party security suites replace Windows Defender Firewall. Add the block in that product instead.
5. You used the allow list. Unchecking an app in Allow an app or feature through Windows Defender Firewall removes an allowance; it doesn’t add an outbound block.
6. The PC is managed. On a work or school PC, firewall rules can come from your organization and override local ones. Ask IT.

For the same technique applied to any program on both Windows 10 and Windows 11, see how to block a program in Windows Firewall.

App blocking questions

Do I need an inbound rule as well?

Usually not. Windows Firewall blocks unsolicited inbound traffic by default, and the outbound rule stops the app from starting connections. If an app runs a server you want closed, an inbound block rule is the extra step. To do the opposite and let something in, see how to open ports in the firewall.

Why did the wizard put %ProgramFiles% in my path?

Windows can store paths with environment variables. Microsoft says environment variables are allowed in the path, but a full path leaves no doubt about which file the rule covers, so it is the safer habit.

Do I need a new rule after the app updates?

Only if the update installs the program to a different folder or changes the file name. Check the path in the rule’s properties after a major update.

Why not just turn the firewall off for a moment?

That removes protection from every app at once, and Microsoft recommends leaving Windows Firewall on. A single rule is safer and easier to undo.

A site stopped loading after I added rules. What now?

Check that you didn’t block your browser by mistake, then see how to allow a website through the firewall.

Start with netstat before you build anything: knowing exactly which file connects is what makes a one-rule block work the first time.