When Should You Disable the Firewall?
By default, the Windows Defender Firewall is enabled on all three network profiles: Domain, Private, and Public. While you should never disable the firewall permanently on a production server, temporarily disabling it is a standard troubleshooting step. If a specific application (like SQL Server or a custom web app) is failing to connect over the network, disabling the firewall completely for two minutes will definitively tell you if a blocked port is the root cause of the issue.
Step 1: Launch an Elevated PowerShell Prompt
Standard users cannot modify firewall rules. You must open PowerShell with administrative privileges.
Click the Start button, type PowerShell, right-click the “Windows PowerShell” app, and select Run as administrator.
Step 2: Check the Current Firewall Status
Before changing anything, it is good practice to view the current state of all three firewall profiles. Run the following cmdlet:
Get-NetFirewallProfile | Format-Table Name, Enabled
This will output a simple table showing the Domain, Private, and Public profiles, and whether they are currently set to True (Enabled) or False (Disabled).
Step 3: Disable the Firewall for a Specific Profile
If your server is joined to an Active Directory domain, you generally only need to disable the Domain profile to test internal connectivity. Run the following command:
Set-NetFirewallProfile -Profile Domain -Enabled False
The command will execute silently without returning any output. If you test your application now and it works, you know you need to create a specific allow rule for that application’s port.
Step 4: Disable the Firewall for All Profiles Simultaneously
If you are troubleshooting a complex multi-homed server and need to quickly drop the firewall completely across every single network interface, you can disable all three profiles at once. The -Profile parameter accepts an array or a wildcard:
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
(Alternatively, you can just use Set-NetFirewallProfile -All -Enabled False in newer Windows builds).
Step 5: Re-enable the Firewall
Once your troubleshooting is complete, it is absolutely critical that you re-enable the firewall to secure the server against lateral network movement and ransomware attacks.
To instantly turn all firewall profiles back on, simply change the -Enabled flag to True:
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
Run the Get-NetFirewallProfile command one last time to verify all profiles are actively protecting the server.