Check Whether Windows Firewall Is on from Command Prompt in Windows 11

Understand the Three Firewall Profiles First

Windows Firewall keeps a separate on/off setting for each of three network profiles (groups of rules that apply depending on the kind of network you are connected to). A check can show ON for one profile and OFF for another, so you need to know which is which.

• Domain profileapplies when your PC is connected to a work or school domain network.
• Private profileapplies on networks you mark as trusted, such as your home Wi-Fi.
• Public profileapplies on networks you do not control, such as a café or airport.

On a home PC, only the Private or Public profile is active at any moment. The command in this guide shows all three at once, so you see the full picture.

Check Whether Windows Firewall Is On from Command Prompt

These steps show whether Windows Firewall is on for every profile, using Command Prompt. A standard Command Prompt window is enough, because reading the status does not need administrator rights.

1. Press the Windows key. The Start menu⊞ opens with the search🔍 box ready.
2. Type cmd in the search🔍 box. Command Prompt appears at the top of the results.
3. Press Enter to open it. A black window opens with a prompt such as C:\Users\USERNAME>.
4. Type netsh advfirewall show allprofiles state and press Enter. Windows prints one block of text for each profile.
5. Find the line that starts with State under each profile heading. ON means the firewall is active for that profile. OFF means it is not.
6. Close the window by typing exit and pressing Enter. Nothing else needs saving.

If Windows Terminal opens when you press Enter in step 3, it may show a PowerShell tab instead of Command Prompt. The netsh command works the same in both, so you can run it where you are.

What the Output Looks Like

The command prints a short block for each profile. The spacing on your screen may differ slightly from this example, but the layout and labels match:

Domain Profile Settings:
----------------------------------------------------------------------
State                                 ON

Private Profile Settings:
----------------------------------------------------------------------
State                                 ON

Public Profile Settings:
----------------------------------------------------------------------
State                                 ON

Ok.

All three profiles show ON in this example, which is the default on a fresh Windows 11 install. The final Ok. confirms that the command ran without errors.

Check Only the Profile You Are Using Right Now

Most people care about the network they are connected to at this moment. The currentprofile profile option limits the report to that profile.

1. Open Command Prompt using the steps above.
2. Type netsh advfirewall show currentprofile and press Enter. The heading shows the active profile, such as Private Profile Settings or Public Profile Settings.
3. Read the State line. It is the first setting listed under the heading.

This version prints more than the state. You also see the Firewall Policy line, which shows the default action for inbound and outbound traffic. The InboundUserNotification line shows whether Windows displays a notification when it blocks an app. For the default inbound rule, you normally see BlockInbound and for outbound AllowOutbound.

Check a Single Named Profile

To check one specific profile, replace allprofiles with the profile name. Use one of these three commands:

• netsh advfirewall show domainprofile state
• netsh advfirewall show privateprofile state
• netsh advfirewall show publicprofile state

This is useful when you want to confirm the Public profile is on before connecting to a shared network, even if you are currently on your home Wi-Fi.

Confirm the Firewall Service Is Running

A firewall shows ON only if its underlying service is running. The service is named mpssvc (the Windows Firewall service, named Windows Defender Firewall in some Windows menus, which enforces the firewall rules). Checking it takes one command.

1. Open Command Prompt.
2. Type sc query mpssvc and press Enter. Windows prints the service details.
3. Find the STATE line. RUNNING means the service is active.

Do not stop this service to switch the firewall off. Microsoft advises against it, and other Windows features depend on it. Use the profile setting instead, as covered in How to Turn On or off Microsoft Defender Firewall in Windows 11.

Check the Firewall State from Command Prompt with PowerShell

PowerShell has a cmdlet (a built-in command) that returns the same information as a clean table. You can call it from inside Command Prompt, so you do not need to switch windows.

1. Open Command Prompt.
2. Type powershell -Command "Get-NetFirewallProfile | Format-Table Name, Enabled" and press Enter. A short table appears with one row per profile.
3. Read the Enabled column. True means the firewall is on for that profile. False means it is off.

This route takes a second or two longer than netsh, because PowerShell has to start first. Its advantage is the compact table, which is easier to scan on a PC with many profile settings or in a script.

Why the Result Can Look Wrong

Sometimes the command output does not match what you expect. These are the most common reasons, in the order worth checking.

A Third-Party Security Product Turned the Firewall Off

Open the antivirus program to confirm its firewall is active. You can also open Settings › Privacy & security › Windows Security › Firewall & network protection. This page tells you when another firewall is in charge. Running two firewalls at once is not recommended, so pick one.

Your Organisation Manages the Setting

On a work or school PC, an administrator can set the firewall state through Group Policy (a central system for pushing settings to many PCs). When that happens, the state you read is the one Windows enforces, and Windows restores the managed setting the next time policy updates, whatever change you make. If the result is surprising, ask your IT team before trying to change it.

The Command Returns an Error

If Command Prompt prints an error instead of the profile blocks, the firewall service may be stopped or damaged. To check the service, run sc query mpssvc from the section on confirming the firewall service is running. A stopped service is often the result of malware, a failed cleanup tool, or a broken update.

If you see 'netsh' is not recognized as an internal or external command, Windows is telling you it cannot find the tool. Run it with its full path instead: C:\Windows\System32\netsh.exe advfirewall show allprofiles state. If that works, your PATH setting (the list of folders Windows searches for commands) needs attention.

The Firewall Is On but an App Is Blocked

An ON state does not mean every program can reach the network. A rule may block one app while the firewall as a whole runs normally. If a program cannot connect, read What to Do When Windows Firewall Blocks Apps You Need for ways to allow it without turning the firewall off.

Check the Same Thing in Settings Instead

The Settings route gives the same answer if you would rather not type commands. Open Settings › Privacy & security › Windows Security, then click Open Windows Security. Select Firewall & network protection.

The page lists the Domain, Private, and Public networks. The active one is marked (active), and each shows whether the firewall is on. A green check mark by a network means the firewall is protecting it. A red cross means it is off.

Turn the Firewall Back On If a Profile Shows OFF

If a profile shows OFF and you did not intend that, turn it on again. This step needs administrator rights, so open Command Prompt by right-clicking it in the Start search results and choosing Run as administrator. Accept the User Account Control (UAC) prompt, the permission box Windows shows before it lets a program make system changes. If you want to adjust how that prompt behaves, see How to Change UAC Prompt Behavior in Windows 11.

Then run the following to switch every profile on:

1. Open an administrator Command Prompt. The title bar shows Administrator: Command Prompt.
2. Type netsh advfirewall set allprofiles state on and press Enter. Windows prints Ok. when the change applies.
3. Run netsh advfirewall show allprofiles state again. Every profile should now show ON.

The change takes effect immediately, and no restart is needed. If you ever need to switch it off for testing, How to Disable Windows Firewall on Windows 11 covers the options and the risks. Turn it back on as soon as the test ends.

What to Do Next

If the firewall is on but behaves strangely after a long history of changes, How to Reset Default Firewall Settings in Windows 11 restores the original rules. Resetting removes custom rules you added, so note any you need first. A related option is How to Enable or Disable Shield up in Windows Firewall on Windows 11, which blocks all incoming connections on a network.

If you want a pop-up when the firewall blocks an app, see Enable or Disable Firewall Notifications in Windows 11. A new network profile, a security software install, or a Windows feature update can change the firewall state later, so run the check again after any of those.