How to Enable or Disable Shield up in Windows Firewall on Windows 11

How to Turn On or Off “Shield up” Mode in Windows Firewall

The Windows Security app is the easiest way to turn Shield Up on or off. You open the firewall settings for your network profile and tick or untick one checkbox. You need an administrator account, or the administrator password, to confirm the change.

1. Open the Windows Security app.
   

   Alternatively, select Start › Settings › Privacy & security › Windows Security › Open Windows Security. (On Windows 10 the path goes through Update & Security instead.) The Windows Security home page opens with a list of protection areas.

   
   
2. In the Windows Security app, select Firewall & network protection.
   

   You should now see the three firewall profiles: Domain network, Private network and Public network. The one marked “active” is the network you are connected to right now.

   

   
   

3. Select the Private network profile.
   

   Pick the profile that matches your current connection. For example, choose Public network if you are on café Wi-Fi📶. Shield Up is set per profile, so turning it on for a profile you aren’t using changes nothing right now.

   

   
   

4. Check the box next to Block all incoming connections, including those in the list of allowed apps to turn on “Shield up” mode.
   

   To turn it off, uncheck the box. If the box is greyed out, the firewall is switched off for that profile. Turn Microsoft Defender Firewall on first. It can also be locked by your organization’s policy if the PC is managed by work or school.

   
   

   

   
   

5. When prompted, click the Yes button to confirm the changes.
   

   This is the User Account Control prompt. The setting takes effect immediately. You don’t need to restart.

6. Close the Windows Security app when done.

Use Control Panel to Block All Incoming Connections

The classic Control Panel firewall page also has the Shield Up setting. It is handy if you prefer the older interface, or if you want to see the settings for all network profiles on one screen.

1. Open the Control Panel🎛️.
   

   Then, select System and Security › Windows Defender Firewall. The firewall status page opens, showing the state of your private and public networks.

   
   
2. Click the Turn Windows Defender Firewall on or off link in the left pane of the Windows Defender Firewall page.
   

   You should now see the Customize Settings page, with separate sections for private and public network settings.

   

   
   

3. Check or uncheck the box next to Block all incoming connections, including those in the list of allowed apps to turn it on or off.
   

   Do this in the section for the network type you want to change. The box is greyed out when the firewall is turned off for that profile. Select Turn on Windows Defender Firewall in that section first, then tick the box. Click OK at the bottom of the page to apply the change.

   

   
   

4. Close the Control Panel🎛️ when you are done.

Turn On or Off Shield Up Mode Using the Windows Registry

You can also turn Shield Up on or off by editing the Windows Registry. This is useful when the graphical settings don’t work or you need to script the change. You set one value for each network profile under the firewall policy keys in 🗝️HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicycopy. You need to be signed in as an administrator.

Registry mistakes can cause real problems, so create a restore point or export the key before you start.

Another way to enable or disable the “Shield up” feature is to use the Windows Registry editor.

1. Open the Windows Registry and navigate to the folder key path below:
   

   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall\StandardProfile

   
   

   The StandardProfile key holds the settings⚙️ for the Private network profile. Click the key so its values appear in the right pane.

   
   
2. Right-click StandardProfile › New › DWORD (32-bit) Value and name the new DWORD DoNotAllowExceptions.
   

   If a value with that name already exists, skip this step and go straight to editing it.

3. Double-click DoNotAllowExceptions and change the value to 1 to block all incoming connections in the “Private network” profile.
   

   Enter 0 to turn it off and allow connections. Click OK to save the value.

   
   

   

   
   

4. To do the same for the “Public network” profile, use this registry path:
   

   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall\PublicProfile

   
   

   Then block or unblock all incoming connections using the DoNotAllowExceptions value name and enter 1 or 0.

   
   
5. For the “Domain network” profile, use this path:
   

   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall\DomainProfile

   
   

   Then block or unblock all incoming connections using the DoNotAllowExceptions value name and enter 1 or 0.

6. Save your changes and restart your🔄 computer.
   

   The Registry Editor writes values as soon as you click OK, so there is no separate save step. Close Registry Editor, then restart so the firewall picks up the new values. Afterwards, open Windows Security › Firewall & network protection and check that the box for your active profile matches what you set.

Summary

Shield Up blocks all incoming connections to keep your computer safe from outside threats, and you can switch it on or off at any time. You can change it in the Windows Security app, the Control Panel, or the Windows Registry, whichever you prefer. Remember to turn it off again once the threat has passed, or incoming features such as Remote Desktop and file sharing will keep failing.

• Multiple ways to do itYou can enable or disable “Shield up” mode through the Windows Security app, Control Panel, or Windows Registry. The Windows Security app is the quickest.
• Complete protectionWhen you turn on this mode, it blocks all incoming connections. It overrides any apps you’ve previously allowed. Outgoing connections that your PC starts are not affected.
• Easy to useThe steps are simple and take just a few minutes to complete. The Windows Security and Control Panel methods apply immediately. The Registry method needs a restart.
• Different network typesYou can apply these settings to Private, Public, or Domain networks based on what you need. Each profile has its own setting.
• Easy to change backYou can turn “Shield up” off anytime if you need to allow incoming connections again. Just uncheck the box, or set the registry value back to its off setting.

By following the steps in this article, you can keep your Windows 11 device safer and protect it from unauthorized access.

Reference: Microsoft