Blocking a program in Windows Defender Firewall stops it from reaching the internet. That is useful for keeping an app from auto-updating, stopping a game or tool from phoning home, keeping an offline program offline, or testing how software behaves without a connection. The trick is to create an outbound rule. The simpler “Allow an app through firewall” screen only controls incoming connections. This guide shows how to block a program on Windows 10 and Windows 11 with the firewall wizard, with a single command, and how to check that the block is working.
Quick Answer
Press Windows key + R, type wf.msc, and press Enter. Click Outbound Rules > New Rule, choose Program, and browse to the app’s .exe file. Select Block the connection, keep all three profiles checked, give the rule a name, and click Finish.
Step 1: Find the Program’s .exe File
- Right-click the app’s shortcut on the desktop or in the Start menu. For Start menu items, choose More > Open file location first, then right-click the shortcut there.
- Choose Properties and look at the Target field. That is the path to the .exe, for example
C:\Program Files\ExampleApp\app.exe. - Alternatively, open Task Manager while the app is running, right-click it, and choose Open file location.
Some programs use several .exe files, such as a launcher, the main app, and an updater. Block each one that connects to the internet.
Step 2: Create an Outbound Block Rule
- Press Windows key + R, type
wf.msc, and press Enter. This opens Windows Defender Firewall with Advanced Security. You can also open Control Panel > Windows Defender Firewall > Advanced settings. - In the left pane, click Outbound Rules.
- In the right pane, click New Rule….
- Select Program and click Next.
- Choose This program path, click Browse, select the .exe file, and click Next.
- Select Block the connection and click Next.
- Leave Domain, Private, and Public checked so the block applies on every network. Click Next.
- Type a clear name, such as “Block ExampleApp,” and click Finish.
To also block incoming connections, repeat the same steps under Inbound Rules.
Block a Program with One Command
Open Command Prompt or PowerShell as administrator (right-click Start and choose the Admin option) and run one of these commands, replacing the path with yours.
| Tool | Command |
|---|---|
| Command Prompt (netsh) | netsh advfirewall firewall add rule name="Block ExampleApp" dir=out program="C:\Program Files\ExampleApp\app.exe" action=block |
| PowerShell | New-NetFirewallRule -DisplayName "Block ExampleApp" -Direction Outbound -Program "C:\Program Files\ExampleApp\app.exe" -Action Block |
| Remove the rule (netsh) | netsh advfirewall firewall delete rule name="Block ExampleApp" |
Commands are handy for blocking many .exe files at once. For example, run a PowerShell loop over every .exe in a program’s folder.
Step 3: Check That the Block Works
- Open the program and try something that needs the internet, such as checking for updates or signing in. It should fail or show “offline.”
- In
wf.msc, your rule appears in Outbound Rules with a red circle icon. - If the app still connects, it probably uses another .exe or a background service. Check Task Manager > Details while it runs to find other processes.
Disable, Edit, or Delete the Rule
- Open
wf.mscand click Outbound Rules. - Find your rule. Click the Name column header to sort alphabetically.
- Right-click it and choose Disable Rule to pause the block, Properties to edit it, or Delete to remove it.
- Block rules win: in Windows Defender Firewall, a block rule overrides any allow rule for the same program.
- Microsoft Store apps: these are harder to block by path. In the rule’s Properties, the Programs and Services tab has an Application packages setting for them.
- Third-party firewalls: if your antivirus includes its own firewall, it may have replaced Windows Defender Firewall. Create the block in that product instead.
- Program updates: if an update moves the .exe to a new folder (some apps include the version number in the path), update the rule.
- Work PCs: Group Policy may control firewall rules, and you may not be able to add your own.
- Find the program’s .exe path.
- Open
wf.msc> Outbound Rules > New Rule > Program. - Select the .exe, choose Block the connection, and apply it to all profiles.
- Name the rule and click Finish, or use one
netshor PowerShell command. - Test the app, and block extra .exe files if it still connects.
Things to Know
Related: Disable Windows Firewall.
Frequently Asked Questions
Does “Allow an app through firewall” block programs?
Unchecking an app there only affects incoming connections. It doesn’t stop the app from connecting out to the internet. Use an outbound rule for that.
Is the process different on Windows 11?
No. wf.msc, the wizard, and the commands are the same in Windows 10 and Windows 11.
Can I block a program only on public Wi-Fi?
Yes. On the Profile step, check only Public.
Will blocking stop the program from working?
Offline features keep working. Features that need the internet, such as sign-in, cloud saves, license checks, and updates, will fail.
Summary
Kermit Matthews is a freelance writer based in Philadelphia, Pennsylvania with more than a decade of experience writing technology guides. He has a Bachelor’s and Master’s degree in Computer Science and has spent much of his professional career in IT management.
He specializes in writing content about iPhones, Android devices, Microsoft Office, and many other popular applications and devices.