How to Restore Windows Firewall After Malware Disables It

A disabled Windows Firewall can leave a computer exposed to unauthorised connections, remote access attempts and further malware activity. Some infections change firewall rules, stop related services or apply restrictive policies so that built-in security tools cannot respond normally.

The problem may appear as a red Windows Security warning, a greyed-out firewall control, or an error saying that Windows cannot change some settings. On a business laptop in Sydney, Melbourne or Brisbane, this can be especially serious when the device connects to office networks, cloud services and public Wi-Fi.

Before repairing the firewall, treat the computer as potentially compromised. Avoid online banking, shopping and access to sensitive work accounts until the system has been checked. Australian users should also be cautious on shared household networks and public hotspots commonly found in libraries, airports and cafés.

The repair process usually involves scanning for active threats, restoring the Windows Defender Firewall service, removing malicious policy changes and resetting damaged firewall rules. The correct method depends on whether the infection is still running and whether you can sign in with an administrator account.

Check The System Before You Restore Protection

Disconnect the affected computer from the internet if suspicious activity continues. Unplug an Ethernet cable or turn off Wi-Fi, but keep access available if a trusted security tool needs to download current definitions. If Windows Security is blocked, use another clean computer to obtain reputable recovery software from its official source.

A rootkit can hide processes and interfere with security settings at a deeper level than ordinary adware. A specialist scan with Malwarebytes Anti-Rootkit can help identify threats that a regular scan may miss. Quarantine detected items, restart when requested and repeat the scan until no further detections appear.

Warning Signs That Need Extra Care

• Windows Security closes immediately after opening.
• The Firewall service repeatedly stops.
• Unknown administrator accounts appear.
• Browser traffic redirects to unfamiliar pages.

If ransomware has encrypted files, do not focus only on firewall repair. Preserve affected data, isolate the machine and document ransom notes or file extensions. Guidance on LockBit recovery options explains why paying an attacker does not guarantee restoration and why evidence should be retained.

• Avoid deleting encrypted files or ransom notes.
• Do not run unknown “decryptor” downloads.
• Record unusual services, programs and network addresses.
• Contact an appropriate incident-response or law-enforcement channel when required.

Restart The Firewall Service

Press Windows + R, enter services.msc, and select OK. Find Windows Defender Firewall in the list. Its startup type should normally be Automatic, and its status should be Running. Open the service properties, choose Automatic, select Start, and apply the change.

If the service refuses to start, check Base Filtering Engine first. Windows Defender Firewall relies on this service, and malware can alter its permissions or dependencies. Start Base Filtering Engine if it is stopped, then try the firewall service again. A missing service, access-denied message or recurring failure may indicate damaged system components or a malicious policy.

You can also use an elevated Command Prompt. Search for Command Prompt, right-click it, select Run as administrator, and run:

sc config BFE start= auto
sc start BFE
sc config MpsSvc start= auto
sc start MpsSvc

The space after start= is required. If the commands produce an access error, avoid downloading registry “fixers” from random forums. Persistent permission problems should be investigated with offline scanning or Windows repair tools.

Reset Damaged Firewall Rules

When the service works but the rules are corrupted, open Windows Terminal (Admin) or PowerShell (Admin) and run:

netsh advfirewall reset

This restores the standard firewall policy and removes custom inbound and outbound rules. It may affect legitimate software, remote administration tools, printers and file-sharing setups. On a home network in Perth or Adelaide, you may need to reauthorise trusted applications after the reset.

You can also use the graphical interface by opening Windows Security, selecting Firewall & network protection, choosing Advanced settings, and selecting Restore default policy. Confirm that the active network profile—Domain, Private or Public—shows that the firewall is on.

Repair method	Best use	Main impact
Restart firewall services	The service is stopped but settings look normal	Restores basic protection without deleting rules
Reset with netsh	Rules are corrupted or altered by malware	Removes custom firewall rules
Restore default policy	Graphical access is available	Returns Windows Firewall to standard settings
Offline malware scan	Threats keep changing settings	Checks outside the normal Windows session

Repair Windows Components And Policies

Open Command Prompt (Admin) and run:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM repairs the Windows component store, while System File Checker replaces damaged protected files. Allow each command to finish. Interrupting either process can leave Windows in an incomplete repair state.

Malware may also change Local Group Policy. On supported editions, open gpedit.msc, go to Computer Configuration > Administrative Templates > Network > Network Connections > Windows Defender Firewall, and review policies for the Domain Profile and Standard Profile. Policies that force the firewall off or block local configuration should be corrected only when you understand their origin. A work-managed device may receive legitimate settings from an employer.

If Group Policy is unavailable, registry changes should be handled carefully. Export relevant keys before editing and create a restore point when possible. Incorrect changes can disable networking or cause further Windows errors, so professional assistance may be safer for a business computer.

Confirm The Firewall Is Working

Restart Windows after repairs, then open Windows Security > Firewall & network protection. Each network profile should show an active firewall unless a trusted third-party security suite manages it. Confirm that notifications are enabled and that Windows does not report an unknown security provider.

Test normal functions such as web browsing, email and approved applications. Do not test by visiting suspicious websites or opening unsolicited attachments. Review Windows Defender Firewall with Advanced Security for unexplained rules, especially those allowing inbound traffic on unusual ports or referring to random executable names.

Keep Windows, browsers and security software updated, and use a standard user account for everyday activity. Back up important documents to a disconnected drive or reputable cloud service. Australian households and small businesses should also protect internet-connected routers with a strong administrator password and current firmware, since restoring the PC firewall cannot secure a vulnerable network device.

When the firewall repeatedly disables itself after a clean reset, assume that the underlying infection or tampering remains unresolved. A full offline scan, system restore or clean Windows installation may be required before the computer can be trusted again.