export [ Path ] FileName

[ Path ] FileName

Required. Specifies, by name, the file where the Windows Firewall with Advanced Security configuration will be written. If the path, file name, or both contain spaces, quotation marks must be used. If you do not specify Path then the command places the file in your current folder. The recommended file name extension is .wfw.

In the following example, the command exports the complete Windows Firewall with Advanced Security service configuration to the file C:\temp\wfas.wfw.

export c:\temp\wfas.wfw

import [ Path ] FileName

[ Path ] FileName

Required. Specifies, by name, the file from which the Windows Firewall with Advanced Security configuration will be imported. If the path, the file name, or both contain spaces, quotation marks must be used. If you do not specify Path, then the command looks in the current folder for the file.

In the following example, the command imports the complete Windows Firewall with Advanced Security service configuration from the file c:\temp\wfas.wfw.

import c:\temp\wfas.wfw

reset [ export [ Path ]FileName ]

[ export [ Path ]FileName ]

Specifies that the current configuration is backed up to the specified file before Windows Firewall with Advanced Security is reset to all default configuration settings and rules. If you do not specify Path, then the command places the file in your current folder. The recommended file name extension is .wfw.

In the following example, the command exports the complete Windows Firewall with Advanced Security configuration to the file c:\Temp\wfas.wfw, and then resets the Windows Firewall with Advanced Security configuration to its default configuration settings and rules.

reset export c:\Temp\wfas.wfw

set ProfileType Parameter Value

ProfileType

Required. Can be any one of the following:

• allprofiles
  
  
• currentprofile
  
  
• domainprofile
  
  
• privateprofile
  
  
• publicprofile
  
  

Parameter Value

Required. Parameter can be one of the following:

• state
  
  
• firewallpolicy
  
  
• settings
  
  
• logging
  
  

See the details for each command for syntax and valid values.

set ProfileType state { on | off | notconfigured }

on

Enable Windows Firewall with Advanced Security when the specified profile is active.

off

Disable Windows Firewall with Advanced Security when the specified profile is active.

notconfigured

Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.

• The default state for all profiles on computers that are running Windows Vista or later versions of Windows is on, for both new installations and upgrades.
  
  
• The default state for all profiles on computers that are running a new installation of Windows Server 2008 or Windows Server 2008 R2 is on. For computers that were upgraded from an earlier version of Windows Server, the state of Windows Firewall with Advanced Security is preserved from the state of Windows Firewall on the previously installed operating system. If Windows Firewall was enabled when the upgrade was started, then Windows Firewall with Advanced Security is enabled for all profiles when the upgrade is completed. If Windows Firewall was disabled when the upgrade was started, then Windows Firewall with Advanced Security is disabled for all profiles when the upgrade is completed.
  
  

To turn Windows Firewall with Advanced Security on for all profiles:

set allprofiles state on

set ProfileType firewallpolicy InboundPolicy,OutboundPolicy

InboundPolicy

Required. Must be one of the following values:

• blockinbound. Blocks inbound network traffic that does not match an inbound rule.
  
  
• blockinboundalways. Blocks all inbound network traffic, including traffic that matches an inbound rule. This effectively blocks all unsolicited inbound network traffic into the computer. Only traffic that is sent in response to an outbound request is allowed.
  
  
• allowinbound. Allows all inbound network traffic, whether or not it matches an inbound rule.
  
  
• notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

OutboundPolicy

Required. Must be one of the following values:

• blockoutbound. Block outbound network traffic that does not match an outbound rule.
  
  
• allowoutbound. Allow all outbound network traffic, whether or not it matches an outbound rule.
  
  
• notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

• The default value for firewallpolicy is blockinbound,allowoutbound.
  
  

To set the behavior for the current network profile to block unsolicited inbound traffic, but allow outbound traffic:

set currentprofile firewallpolicy blockinbound, allowoutbound

set ProfileType settings SettingName { enable | disable | notconfigured }

SettingName is one of the items in the following table:

localfirewallrules

• enable. Firewall rules defined by the local administrator are merged with firewall rules from GPOs and are applied to the computer.
  
  
• disable. Rules defined by the local administrator are ignored, and only firewall rules from GPOs are applied to the computer.
  
  
• notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

The default setting when managing a computer is enable. When managing a GPO, the default setting is notconfigured.

localconsecrules

• enable. IPsec connection security rules defined by the local administrator are merged with connection security rules from GPOs and are applied to the computer.
  
  
• disable. Rules defined by the local administrator are ignored, and only connection security rules from GPOs are applied to the computer.
  
  
• notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

The default setting for managing a computer is enable. When managing a GPO, the default setting is notconfigured.

inboundusernotification

• enable. Windows notifies the user whenever a program or service starts listening for inbound connections.
  
  
• disable. Windows does not notify the user whenever a program or service starts listening for inbound connections.
  
  
• notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

On Windows Vista and Windows 7, the default value when managing a computer is enable.On Windows Server 2008 and Windows Server 2008 R2, the default value when managing a computer is disable. When managing a GPO, the default setting for both operating systems is notconfigured.

remotemanagement

• enable. Users with appropriate permissions on remote computers can manage the Windows Firewall with Advanced Security settings on this computer. This is equivalent to enabling the "Windows Firewall Remote Management" rule group for the profile.
  
  
• disable. The Windows Firewall with Advanced Security settings on this computer cannot be managed from a remote computer.
  
  
• notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

To use netsh to manage a remote computer, use the set machine command. For more information, see Netsh Commands for All Contexts.The default setting for managing a computer is disable. When managing a GPO, the default setting is notconfigured.

unicastresponsetomulticast

• enable. The computer can receive unicast responses to outgoing multicast or broadcast messages.
  
  
• disable. The computer discards unicast responses to outgoing multicast or broadcast messages.
  
  
• notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

The default setting for managing a computer is enable. When managing a GPO, the default setting is notconfigured.

To enable the local computer to be managed by another computer when the local computer is connected using the Private profile:

set privateprofile settings remotemanagement enable

To prevent the computer from accepting inbound unicast responses to outbound multicast traffic in the currently active profile:

set currentprofile settings unicastresponsetomulticast disable

Configures firewall logging settings related to Windows Firewall with Advanced Security.

Syntax

Parameters

Remarks

Examples

set global statefulftp { enable | disable | notconfigured }

statefulftp can be set to one of the following values:

enable

The firewall tracks the port numbers specified in PORT command requests and in the responses to PASV requests, and then allows the incoming FTP data traffic entering on the requested port number.

disable

This is the default value. The firewall does not track outgoing PORT commands or PASV responses, and so incoming data connections on the PORT or PASV requested port is blocked as an unsolicited incoming connection.

notconfigured

Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.

• The default setting when managing a computer running Windows Vista or Windows 7 is enable. The default setting when managing a computer running Windows Server 2008 or Windows Server 2008 R2 is disable. When managing a GPO, the default setting is notconfigured.
  
  

• To configure Windows Firewall with Advanced Security to allow FTP data traffic through Windows Firewall when using either PORT or PASV commands:
  
  set global statefulftp enable
  
  

set global ipsec SettingName Value

SettingName is one of the items in the following table:

strongcrlcheck

Specifies whether IPsec checks certificates used in authentication against a certificate revocation list (CRL), and how it reacts to a certificate that is found to be on a CRL.Value can be one of the following:

• 0. Specifies that IPsec does not perform any CRL checking.
  
  
• 1. Specifies that IPsec authentication fails only if the certificate is found to be revoked.
  
  
• 2. Specifies that IPsec authentication fails if there is any error during CRL checking, including a failure to retrieve the CRL.
  
  
• notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

The default setting when managing a local computer is 1. When managing a GPO, the default value is notconfigured.

saidletimemin

An integer from 5 to 60 that specifies the number of minutes that a security association (SA) can stay idle before it is deleted. Once deleted, a new SA must be established before computers under the scope of the original SA can communicate again.notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.The default setting when managing a local computer is 5 (minutes). When managing a GPO, the default value is notconfigured.

defaultexemptions

Specifies the protocols to be exempted from IPsec requirements. Value can be one of, or a comma separated list of, the following items:

• none. No protocols are exempted.
  
  
• neighbordiscovery. Exempt IPv6 Neighbor Discovery protocol traffic.
  
  
• icmp. Exempt ICMP (both IPv4 and IPv6) protocol traffic. This option is available on computers that are running Windows 7 or Windows Server 2008 R2.
  
  
• dhcp. Exempt DHCP (both IPv4 and IPv6) protocol traffic. This option is available on computers that are running Windows 7 or Windows Server 2008 R2.
  
  
• notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

The default setting when managing a local computer that is running Windows 7 or Windows Server 2008 R2 is neighbordiscovery,dhcp. For computers that are running earlier versions of Windows, the default is neighbordiscovery. When managing a GPO, the default value is notconfigured.

ipsecthroughnat

Specifies whether IPsec can configure a security association (SA) when one or both computers involved are behind a network address translation (NAT) device. Value can be one of:

• never. Specifies that an SA cannot be negotiated if either computer is behind a NAT device.
  
  
• serverbehindnat. Specifies that an SA can be negotiated if only the server is on a private subnet behind a NAT device.
  
  
• serverandclientbehindnat. Specifies that an SA can be negotiated if either or both of the computers are on private subnets behind NAT devices.
  
  
• notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

The default setting when managing a local computer is Never. When managing a GPO, the default value is notconfigured.

authzcomputergrp

Specifies the computer accounts or groups of computer accounts that are authorized to establish tunnel connections to the local computer that match this rule. This setting is valid on computers that are running Windows 7 or Windows Server 2008 R2 only, and is ignored on earlier versions of Windows. Value can be one of:

• none. Specifies that access to the tunnel is not restricted based on computer account.
  
  
• <SDDL string>. A string that identifies computer or group accounts and the permissions granted or denied to those accounts. See the Remarks section for more information.
  
  
• notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

authzusergrp

Specifies the user accounts or groups of user accounts that are authorized to establish tunnel connections to the local computer that match this rule. This setting is valid on computers that are running Windows 7 or Windows Server 2008 R2 only, and is ignored on earlier versions of Windows. Value can be one of:

• none. Specifies that access to the tunnel is not restricted based on user account.
  
  
• <SDDL string>. A string that identifies user or group accounts and the permissions granted or denied to those accounts. See the Remarks section for more information.
  
  
• notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

• For more information about SDDL strings and their format, see "Security Descriptor String Format" (http://go.microsoft.com/fwlink/?linkid=109950) on the Microsoft MSDN Web site.
  
  One way to find the SDDL strings for computer, user, or group accounts is to use the Windows Firewall with Advanced Security MMC snap-in to create a temporary firewall rule. If the accounts of interest are domain accounts, you must run the snap-in on a computer that is joined to the domain with the accounts. Be sure to disable the rule so that it cannot interfere with any network traffic. On the Users and Computers tab, select Only allow connections from these computers, and then click the Add button to find the computer or machine group account of interest. You can also select the Only allow connections from these users, and then click the Add button to find the user or group account of interest. After creating the rule, you can use the command netsh advfirewall firewall show rule name=rulename verbose to view the SDDL string for that computer or group. Be sure to delete the temporary rule when you are finished.
  
  

• To configure IPsec to reject a connection attempt when certificate-based authentication fails, or if the CRL check encounters any error:
  
  set global ipsec strongcrlcheck 2
  
  
• To configure IPsec to delete an SA after 15 minutes:
  
  set global ipsec saidletimemin 15
  
  

set global mainmode SettingName Value

SettingName is one of the items in the following table:

mmkeylifetime

Specifies the number of minutes and number of sessions established for a Main Mode SA before it expires and must be renegotiated. The format is:num min,numsessA value of 0 for either means that the SA does not expire based on the type specified. For example, the values 480min,0sess indicate that the SA expires every eight hours, but does not expire because of a certain number of sessions established.notconfigured. Valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.The default value is 480min,0sess.

mmsecmethods

Specifies the Diffie-Hellman key exchange group, integrity, and encryption protocols that are offered in IPsec negotiations with other computers. The format is either:

• keyexch : enc - integrity[,enc-integrity][,…]
  
  Where:
  
  keyexch is one of:
  
  dhgroup1 | dhgroup2 | dhgroup14 | ecdhp256 | ecdhp384
  
  enc is one of:
  
  des | 3des | aes128 | aes192 | aes256
  
  integrity is one of:
  
  md5 | sha1 | sha256 | sha384
  
  You can enter multiple combinations of enc-integrity algorithms that use the same keyexch algorithm, by following the keyexch entry with the first enc-integrity pair, followed by additional pairs that are separated by commas.
  
  
• default. When managing the local computer policy store, this entry is equivalent to entering the following entry:
  
  dhgroup2:aes128-sha1,dhgroup2:3des-sha1
  
  When you are managing a GPO, this option behaves similarly to the notconfigured option, allowing the highest precedence policy that applies to the computer, and that does specify an mmsecmethods value to control the setting. If none of the GPOs or the local computer policy store sets the value, then the computer uses the value string displayed above.
  
  
• notconfigured. Valid only when netsh is configuring a GPO by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.
  
  

The default value is dhgroup2:aes128-sha1,dhgroup2:3des-sha1.

Note
We recommend that you do not use DHGroup1, DES, or MD5. They are no longer considered secure, and are provided for backward compatibility purposes only.

mmforcedh

Specifies that IPsec uses Diffie-Hellman exchanges to protect the main mode key exchange when AuthIP is used. This provides stronger security for the key exchange.Value is either yes, no or notconfigured.notconfigured is valid only when netsh is configuring a Group Policy object by using the set store command. Removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.The default setting is no.This option is available only on computers that are running Windows 7 or Windows Server 2008 R2.

• To configure IPsec to expire a Main Mode SA after four hours or 1000 sessions:
  
  set global mainmode mmkeylifetime 240min,1000sess
  
  
• To configure IPsec to use a specific Main Mode set:
  
  set global mainmode mmsecmethods dhgroup2:des-md5,3des-sha1
  
  
• To configure IPsec to use the default Main Mode set:
  
  set global mainmode mmsecmethods default
  
  
• To configure IPsec to use DH for AuthIP as well as IKE set:
  
  set global mainmode mmforcedh yes
  
  

set store { local | gpo = ComputerName | gpo = localhost | gpo = domain\GPOName | gpo = domain\GPOUniqueID }

local

Specifies that changes from subsequent commands are applied to the policy store on the local computer.

gpo =  ComputerName

Specifies that changes from subsequent commands are applied to the computer with the indicated name in its local Group Policy object.

Note
The local GPO is separate from the local computer's policy store. It is stored on the local computer, not in Active Directory, and is merged with the Active Directory applied Group Policy objects when they are applied to the computer.

gpo = localhost

Specifies that changes from subsequent commands are applied to a special Group Policy object that exists on the local computer. Changes made to the GPO are stored, but are never applied to the active configuration of the computer. Once the localhost GPO is configured, you can then use the export command to extract the configuration into a file that can then be applied to the active configuration of another computer, or to a different GPO by using the export command.

gpo =  Domain \ GPOName

Specifies that changes from subsequent commands are applied to the Group Policy object stored on domain Domain, and named GPOName.

gpo =  domain \ GPOUniqueID

Specifies that changes from subsequent commands are applied to the Group Policy object stored on domain Domain, and identified by the GUID GPOUniqueID.

• You must stay in the same interactive netsh session otherwise the store setting is lost.
  
  
• A domain name needs to be fully specified, including its Domain Name System (DNS) zone.
  
  

Set the policy store to the GPO on computer1:

set store gpo=computer1

Set the policy store to the GPO called laptops in the office.example.com domain:

set store gpo=office.example.com\laptops

Set the policy store to the GPO with a specific GUID in the office domain:

set store gpo=office.example.com\{842082DD-7501-40D9-9103-FE3A31AFDC9B}

Show  ProfileType [ Parameter ]

ProfileType

Required. The value can be one of the following:

• allprofiles
  
  
• currentprofile
  
  
• domainprofile
  
  
• privateprofile
  
  
• publicprofile
  
  

[ Parameter ]

If not specified, then all of the following information is displayed:

• state. Displays whether the Windows Firewall is enabled or not for the specified profile. See set state.
  
  
• firewallpolicy. Displays the handling rules configured in the specified profile for inbound and outbound network traffic that does not match a separately defined firewall rule. See set firewallpolicy.
  
  
• settings. Displays the general settings configured in the specified profile. See set settings.
  
  
• logging. Displays the logging settings configured in the specified profile. See set logging.
  
  

To display all settings for all profiles:

show allprofiles

To display the firewall state for the current profile:

show currentprofile state

To display the current profile, and all of its settings:

show currentprofile

show global [ { ipsec | mainmode | statefulftp } ]

[{ipsec|mainmode|statefulftp}]

The value can be one of the following. If not specified, then all of the following information is displayed:

• ipsec. Displays the current configuration of global IPsec options.
  
  
• mainmode. Displays the current configuration of options that control how IPsec performs Main Mode negotiations.
  
  
• statefulftp. Displays the current configuration of the option which controls how Windows Firewall with Advanced Security handles FTP network traffic. For more information, see set global statefulftp.
  
  

To display global IPsec configuration options:

show global ipsec

To display all global configuration options:

show global

show store

None.

To display the policy store currently being used by netsh advfirewall:

show store