# Windows: precedence and identities

Review effective firewall policy, services and updated executable paths.

Updated: 2026-11-05
Canonical: https://shortant.ai/en/guides/platform-windows/

Adapted from Public Network Protection Guide 3.0.1. Read-only review first; no universal executable configuration is supplied.

## Do not use conflicting blanket rules

Windows Firewall gives conflicting explicit block rules precedence over allows. An all-application block plus a narrow allow is not a generic exception recipe. Verify the actual engine and effective merged policy.

Do not change the whole machine’s default outbound policy for one workload. Confirm exact program/package or authorized identity scope and the conjunction of identity, endpoint and protocol.

## Services, entries and updates

Test terminal, original executable, Start menu, IDE and scheduled entry. Children, elevated helpers and services under another identity are not automatically covered. Paths may change after updates.

WSL and VMs need host and guest checks. Keep remote access and other software intact; filter/driver failure is unknown until safely tested.

## Sources and scope

- [Microsoft Windows Firewall rule behavior](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/rules)

Independent educational adaptation; vendor documents retain their owners’ rights. Check the installed version and applicability. Browser scores do not verify local isolation, account access or ban risk.