Windows Defender Firewall: 'Cannot Change Settings' Fix

Quick answer for advanced users

Run reg delete "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall" /f in an admin Command Prompt, then restart the firewall service. That clears group policy locks instantly.

Why your firewall settings are stuck

You click the Windows Defender Firewall settings, and everything is grayed out. The buttons don't work. It feels like something broke. But it's probably not broken — it's locked by a policy. Group Policy (from your IT admin, a previous corporate setup, or a third-party antivirus) pulls a lever that says "users can't touch this." Or, your firewall profile got corrupted after a Windows update. The netsh advfirewall set of commands is your best friend here.

Step-by-step fix

1. Open Command Prompt as admin. In Windows 10/11, hit Start, type cmd, right-click Command Prompt, select "Run as administrator."
2. Run this command to see the current policy:

   gpresult /r

   Look for lines that say "Applied Group Policy Objects: Windows Firewall" or similar. If you see firewall policies, that's your problem.
3. Check the registry for locks:

   reg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall"

   If this returns anything, the firewall is locked by policy.
4. Delete the policy key:

   reg delete "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall" /f

   This wipes the policy that blocks changes.
5. Restart the firewall service:

   net stop MpsSvc && net start MpsSvc

   This flushes the old policy.
6. Check the local group policy editor (if you have Windows Pro or Enterprise): Press Win + R, type gpedit.msc. Go to Computer Configuration > Administrative Templates > Network > Network Connections > Windows Defender Firewall. Set all policies to "Not Configured." Then run gpupdate /force in an admin Command Prompt.
7. If still stuck, reset the firewall completely:

   netsh advfirewall reset

   Then restart your PC.

Alternative fixes if the main one fails

1. Corrupted profile

Your firewall profile file might be broken. Go to C:\Windows\System32\GroupPolicy. Delete everything inside (yes, all folders). Then run gpupdate /force and restart. That rebuilds the policy files.

2. Third-party antivirus interference

Norton, McAfee, or Bitdefender often disable Windows Firewall and lock its settings. Open your antivirus dashboard, look for a setting like "Firewall Control" or "Network Shield," and disable it temporarily. Then try the steps above.

3. User account control (UAC) glitch

Sometimes UAC prevents the firewall control panel from running with full admin rights. Change UAC slider to "Never notify" (temporary), reboot, make your firewall changes, then bump it back to the default setting.

Prevention tip

If you ever rejoin a corporate domain or install antivirus, the firewall locks can return. Make a backup of your firewall rules with netsh advfirewall export "C:\firewall-backup.wfw". Then if things break later, import it back with netsh advfirewall import "C:\firewall-backup.wfw". Takes 10 seconds.

I've seen this error on Windows 10 22H2 and Windows 11 23H2 after a feature update. The registry key deletion fix works every time for non-enrolled personal devices. For work laptops, ask your IT — don't delete policies there.