How to Enable or Disable Windows Firewall in Batch Script

Learn how to use Batch scripts with netsh advfirewall commands to safely enable, disable, or audit Windows Firewall states for all profiles or specific network types.

The Windows Firewall is a critical security layer that protects your system from unauthorized access. However, there are times, such as during the setup of a complex server application or while troubleshooting deep networking issues, where you need to temporarily disable the firewall to verify if it's the cause of a connection failure. Rather than navigating through multiple Control Panel menus, a Batch script can use the netsh advfirewall command to toggle the state of the firewall for all profiles simultaneously or just a specific one.

This guide will explain how to control the global state of your firewall.

Method 1: Disabling the Firewall (All Profiles)

This is the most common command for troubleshooting. It turns off the firewall for the Domain, Private, and Public profiles at once.

@echo off
setlocal enabledelayedexpansion

:: Check for Administrator privileges
net session >nul 2>&1
if !errorlevel! neq 0 (
    echo [ERROR] This script requires Administrator privileges.
    echo         Right-click and select "Run as administrator."
    pause
    endlocal
    exit /b 1
)

set "LogFile=%USERPROFILE%\firewall_changes.log"

:: Show current state before making changes
echo [CURRENT STATE]
netsh advfirewall show allprofiles state 2>nul | findstr /i "State"
echo.

:: Confirm the dangerous action
echo [WARNING] You are about to DISABLE the Windows Firewall on ALL profiles.
echo          Your system will be vulnerable to network attacks.
echo.
set /p "confirm=Are you sure? Type YES to confirm: "
if /i "!confirm!" neq "YES" (
    echo [CANCELLED] No changes made. Firewall remains active.
    pause
    endlocal
    exit /b 0
)

echo.
echo [ACTION] Disabling Windows Firewall on all profiles...

:: Set the state to OFF
netsh advfirewall set allprofiles state off >nul 2>&1

if !errorlevel! equ 0 (
    echo [WARNING] Firewall is now OFF. Your system is vulnerable.
    echo.
    echo [IMPORTANT] Remember to re-enable it when testing is complete:
    echo             netsh advfirewall set allprofiles state on
    echo [%date% %time%] DISABLED firewall (all profiles^) by %USERNAME% >> "%LogFile%"
) else (
    echo [ERROR] Failed to disable firewall.
)

:: Verify the change
echo.
echo [VERIFY]
netsh advfirewall show allprofiles state 2>nul | findstr /i "State"

pause
endlocal

Method 2: Enabling the Firewall (Restore Safety)

When your testing is finished, use this to restore protection.

@echo off
setlocal enabledelayedexpansion

:: Check for Administrator privileges
net session >nul 2>&1
if !errorlevel! neq 0 (
    echo [ERROR] This script requires Administrator privileges.
    pause
    endlocal
    exit /b 1
)

set "LogFile=%USERPROFILE%\firewall_changes.log"

echo [ACTION] Restoring Firewall protection on all profiles...

:: Set the state to ON
netsh advfirewall set allprofiles state on >nul 2>&1

if !errorlevel! equ 0 (
    echo [SUCCESS] Firewall is active on all profiles.
    echo [%date% %time%] ENABLED firewall (all profiles^) by %USERNAME% >> "%LogFile%"
) else (
    echo [ERROR] Failed to enable firewall.
)

:: Verify the change
echo.
echo [VERIFY]
netsh advfirewall show allprofiles state 2>nul | findstr /i "State"

pause
endlocal

Method 3: Targeted Profile Control

Sometimes you want to keep the "Public" firewall ON (security) while turning the "Domain" firewall OFF (internal trust within your corporate network).

@echo off
setlocal enabledelayedexpansion

:: Check for Administrator privileges
net session >nul 2>&1
if !errorlevel! neq 0 (
    echo [ERROR] This script requires Administrator privileges.
    pause
    endlocal
    exit /b 1
)

set "LogFile=%USERPROFILE%\firewall_changes.log"

echo [SETUP] Customizing Firewall profile states...
echo.

:: Show current state
echo [CURRENT STATE]
netsh advfirewall show allprofiles state 2>nul | findstr /i "Profile State"
echo.

echo Select a profile to modify:
echo   1. Domain Profile
echo   2. Private Profile
echo   3. Public Profile
echo   4. All Profiles
echo.
set /p "ProfileChoice=Enter choice (1-4): "

set "ProfileName="
set "ProfileParam="
if "%ProfileChoice%"=="1" set "ProfileName=Domain" & set "ProfileParam=domainprofile"
if "%ProfileChoice%"=="2" set "ProfileName=Private" & set "ProfileParam=privateprofile"
if "%ProfileChoice%"=="3" set "ProfileName=Public" & set "ProfileParam=publicprofile"
if "%ProfileChoice%"=="4" set "ProfileName=All" & set "ProfileParam=allprofiles"

if not defined ProfileName (
    echo [ERROR] Invalid choice.
    pause
    endlocal
    exit /b 1
)

echo.
echo Select action:
echo   1. Enable (turn ON^)
echo   2. Disable (turn OFF^)
echo.
set /p "ActionChoice=Enter choice (1-2): "

set "State="
set "ActionDesc="
if "%ActionChoice%"=="1" set "State=on" & set "ActionDesc=ENABLED"
if "%ActionChoice%"=="2" set "State=off" & set "ActionDesc=DISABLED"

if not defined State (
    echo [ERROR] Invalid choice.
    pause
    endlocal
    exit /b 1
)

:: Extra warning for disabling Public profile
if "%ProfileChoice%"=="3" if "%ActionChoice%"=="2" (
    echo.
    echo [!! DANGER !!] Disabling the PUBLIC profile removes protection on
    echo                untrusted networks (coffee shops, airports, hotels^).
    echo.
    set /p "pubConfirm=Type YES to confirm: "
    if /i "!pubConfirm!" neq "YES" (
        echo [CANCELLED] No changes made.
        pause
        endlocal
        exit /b 0
    )
)

echo.
echo [ACTION] Setting !ProfileName! profile to !State!...
netsh advfirewall set !ProfileParam! state !State! >nul 2>&1

if !errorlevel! equ 0 (
    echo [SUCCESS] !ProfileName! profile has been !ActionDesc!.
    echo [%date% %time%] !ActionDesc! firewall (!ProfileName! profile^) by %USERNAME% >> "%LogFile%"
) else (
    echo [ERROR] Failed to change firewall state.
)

:: Show updated state
echo.
echo [UPDATED STATE]
netsh advfirewall show allprofiles state 2>nul | findstr /i "Profile State"

pause
endlocal

Method 4: Auto-Restore (Timed Disable)

Disables the firewall for a specified number of minutes, then automatically re-enables it. This prevents accidentally leaving the system unprotected.

@echo off
setlocal enabledelayedexpansion

:: Check for Administrator privileges
net session >nul 2>&1
if !errorlevel! neq 0 (
    echo [ERROR] This script requires Administrator privileges.
    pause
    endlocal
    exit /b 1
)

set "Duration=5"
if "%~1" neq "" set "Duration=%~1"

set "LogFile=%USERPROFILE%\firewall_changes.log"

echo [TIMED DISABLE] Firewall will be disabled for %Duration% minute(s^)
echo                 and then automatically re-enabled.
echo.

:: Confirm
set /p "confirm=Proceed? (Y/N): "
if /i "!confirm!" neq "Y" (
    echo [CANCELLED] No changes made.
    pause
    endlocal
    exit /b 0
)

:: Disable
echo.
echo [ACTION] Disabling firewall...
netsh advfirewall set allprofiles state off >nul 2>&1

if !errorlevel! neq 0 (
    echo [ERROR] Failed to disable firewall.
    pause
    endlocal
    exit /b 1
)

echo [WARNING] Firewall is now OFF.
echo [%date% %time%] TIMED DISABLE (%Duration% min^) started by %USERNAME% >> "%LogFile%"

:: Countdown
set /a TotalSeconds=!Duration!*60
set /a Remaining=!TotalSeconds!

echo.
echo [TIMER] Firewall will be restored in %Duration% minute(s^).
echo         Press CTRL+C to cancel (firewall will stay OFF - re-enable manually!^)
echo.

:Countdown
if !Remaining! leq 0 goto :Restore

set /a Minutes=!Remaining!/60
set /a Seconds=!Remaining!%%60

echo [!time!] Re-enabling in !Minutes!m !Seconds!s...

set /a WaitTime=30
if !Remaining! lss 30 set /a WaitTime=!Remaining!
timeout /t !WaitTime! >nul
set /a Remaining-=!WaitTime!
goto :Countdown

:Restore
echo.
echo [ACTION] Timer expired - restoring firewall protection...
netsh advfirewall set allprofiles state on >nul 2>&1

if !errorlevel! equ 0 (
    echo [SUCCESS] Firewall has been automatically RE-ENABLED.
    echo [%date% %time%] AUTO-RESTORED firewall after %Duration% min by %USERNAME% >> "%LogFile%"
) else (
    echo [ERROR] Failed to re-enable firewall! Re-enable manually:
    echo         netsh advfirewall set allprofiles state on
)

:: Verify
echo.
echo [VERIFY]
netsh advfirewall show allprofiles state 2>nul | findstr /i "State"

pause
endlocal

Usage: Run with an optional duration in minutes:

firewall_timed_disable.bat 10

Defaults to 5 minutes if no argument is provided.

Method 5: Status Check Only (No Changes)

A read-only script that shows the current firewall state across all profiles, useful for auditing without making changes.

@echo off
setlocal

echo [AUDIT] Windows Firewall Status Report
echo        %COMPUTERNAME% - %date% %time%
echo.

:: Show state per profile
echo === FIREWALL PROFILE STATES ===
echo.
netsh advfirewall show allprofiles 2>nul | findstr /i "Profile State"
echo.
echo ===============================

:: Show which profile is currently active
echo.
echo === ACTIVE NETWORK PROFILE ===
echo.
powershell -NoProfile -Command ^
  "$profiles = Get-NetConnectionProfile -ErrorAction SilentlyContinue;"^
  "if ($profiles) {"^
  "  foreach ($p in $profiles) {"^
  "    Write-Host ('  Interface: {0}' -f $p.InterfaceAlias);"^
  "    Write-Host ('  Network:   {0}' -f $p.Name);"^
  "    Write-Host ('  Category:  {0}' -f $p.NetworkCategory);"^
  "    Write-Host ''"^
  "  }"^
  "} else {"^
  "  Write-Host '  No active network connections.'"^
  "}"

echo ===============================

pause
endlocal

How to Avoid Common Errors

Wrong Way: Stopping the `MpsSvc` Service

Some users try to disable the firewall by running net stop MpsSvc (the Windows Firewall Service). On Windows 10 and 11, stopping this service can break other core features like Windows Updates, certain Store apps, and Windows Security Center.

Correct Way: Use the netsh advfirewall command. This leaves the service running but instructs it to allow all traffic. This is the only supported way to disable the firewall without breaking underlying OS functionality:

:: Correct
netsh advfirewall set allprofiles state off

:: Wrong (breaks other features)
net stop MpsSvc

Wrong Way: Disabling Without a Plan to Re-Enable

The most common firewall incident is disabling "temporarily" and forgetting to re-enable. Days or weeks later, the machine is compromised.

Correct Way: Use Method 4 (timed disable) which automatically re-enables the firewall after a set duration. Or at minimum, add a re-enable command at the end of your troubleshooting script:

:: Your testing commands here
echo Testing connectivity...
ping server.local

:: Always re-enable at the end
netsh advfirewall set allprofiles state on

Wrong Way: Disabling All Profiles When Only One Needs Testing

Disabling all three profiles (Domain, Private, Public) when your issue is only on the Domain network unnecessarily exposes other interfaces.

Correct Way: Disable only the specific profile you're troubleshooting (Method 3):

:: Only disable Domain profile
netsh advfirewall set domainprofile state off

:: Leave Private and Public protected

Wrong Way: Running Without Administrator Privileges

Modifying global security states is a highly restricted action. Without elevation, the command fails silently or returns a generic "Access Denied" error.

Correct Way: Always check for elevation at the start:

net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Run as Administrator.
    exit /b 1
)

Best Practices and Rules

1. Always Verify After Changes

Confirm the state has actually changed by running an audit check:

netsh advfirewall show allprofiles state

All methods above include automatic verification.

2. Use Auto-Restore for Testing

Method 4 provides a timed disable that automatically re-enables the firewall. This is the safest approach for troubleshooting: it eliminates the risk of forgetting to re-enable protection.

3. Log Every Toggle

In a corporate environment, disabling the firewall is a major security event. Always log when and why it was done. All methods above include automatic logging to %USERPROFILE%\firewall_changes.log.

4. Understand Firewall Profiles

Profile	When Active	Typical Setting
Domain	Connected to a corporate Active Directory network	Often less restrictive (trusted network)
Private	Connected to a home or trusted network	Moderate restrictions
Public	Connected to an untrusted network (café, airport)	Most restrictive - never disable this on public Wi-Fi

5. Prefer Targeted Rules Over Full Disable

Instead of disabling the entire firewall to test a connection, try adding a temporary allow rule for just the specific port or application:

:: More targeted approach
netsh advfirewall firewall add rule name="TEMP_TEST" dir=in action=allow localport=8080 protocol=tcp

:: Test your connection...

:: Remove the temporary rule
netsh advfirewall firewall delete rule name="TEMP_TEST"

6. Always Use `setlocal` / `endlocal`

Without setlocal, every variable your script creates persists in the parent shell session, causing potential conflicts when running multiple scripts in sequence.

Conclusions

Controlling the Windows Firewall via Batch script provides an essential tool for rapid troubleshooting and system configuration. By moving from manual GUI toggles to automated command-line control, you gain the ability to conduct clean network testing without unnecessary delays. This efficiency is vital for system administrators and developers who need to isolate networking bottlenecks while maintaining a high standard of system safety.