Turns the firewall on for the Domain, Private and Public profiles, reporting which ones were already enabled and which were switched, then verifies the result afterwards. Profiles are handled one by one rather than in bulk, so a profile that refuses to change is visible instead of hidden behind a success message.
powershell
# Enable Windows Firewall (all profiles)
# Single use case: turn the firewall on for Domain, Private and Public
#-----------------------------------------------------------------
function Write-Log {
param($Message)
Write-Host "<WRITE-LOG = `"*$Message*`">"
}
$profiles = Get-NetFirewallProfile -ErrorAction SilentlyContinue
if (-not $profiles) { Write-Log "Could not read firewall profiles!"; return }
$changed = 0
foreach ($p in $profiles) {
if ($p.Enabled -eq $true) {
Write-Log "Profile $($p.Name): already enabled."
} else {
Set-NetFirewallProfile -Name $p.Name -Enabled True
Write-Log "Profile $($p.Name): ENABLED (was off)."
$changed++
}
}
$after = Get-NetFirewallProfile | Where-Object { $_.Enabled -ne $true }
if ($after) {
Write-Log "WARNING: $(@($after).Count) profile(s) still disabled!"
} else {
Write-Log "Firewall active on all profiles ($changed changed)."
}Run it across your fleet
This script runs as-is on a single host. Paste it into ServerEngine to schedule it, run it on a whole server group in parallel, and keep the credentials out of the file — see the scripts documentation and the credential store.
More in Security & Auditing
Check Windows Firewall Status with PowerShell
2026-08-17Disable SMBv1 with PowerShell
2026-08-17Enforce TLS 1.2 in the Registry with PowerShell
2026-08-17Enable RDP Network Level Authentication with PowerShell
2026-08-17Audit the Local Administrators Group with PowerShell
2026-08-17Audit Failed Logons (Event 4625) with PowerShell
2026-08-17Ready when you are.
Try ServerEngine free for 7 days.