Use Windows Defender Firewall with Advanced Security to block network access for selected applications. Create reversible outbound rules and verify that essential local features still work.
Incorrect firewall rules can break application connectivity, updates, licensing, or security functions. Do not disable the firewall or antivirus to troubleshoot a single application. Blocking one executable may not prevent related processes from accessing the network.
Create application-specific outbound block rules in **Windows Defender Firewall with Advanced Security** for software that does not need network access. These rules reduce connectivity but do not replace malware protection or guarantee that the application cannot communicate through another executable or service.
Locate the executable belonging to the application you want to restrict. Confirm its publisher and installation directory before creating a rule. Blocking the wrong executable may affect an updater, helper process, or unrelated application.
Search for **Windows Defender Firewall with Advanced Security** and open it as administrator. Select **Outbound Rules**. Outbound rules control connections initiated by applications; they are distinct from inbound rules that govern incoming connections.
Choose **New Rule**, select **Program**, and specify the verified executable path. Select **Block the connection** and apply the rule to the network profiles appropriate for your device. A block rule can prevent the app from signing in, downloading content, or checking for updates.
Give the rule a clear name that identifies the application and purpose. Add a description if your Windows version offers one, and record the executable path and selected profiles. Descriptive names make later troubleshooting and rollback easier.
Launch the application and test the functions you expect to work offline. Confirm that unrelated applications, Windows Update, and Microsoft Defender still have normal connectivity. Some programs delegate network access to helper processes, so blocking one executable may not block every connection associated with the software.
If the application updates or moves to another installation directory, confirm that the rule still targets the intended executable. Remove stale rules only after identifying their purpose. Re-test the application after any major update.
Confirm that the rule is enabled and targets the actual executable. Check whether a helper process, Windows service, or alternate executable performs the connection.
Disable the block rule temporarily and test the updater. If connectivity is required, remove or narrow the rule instead of disabling the firewall globally.
Open the rule's Advanced tab and review its Domain, Private, and Public profile selections. Adjust only the profiles you intend to cover.
No. It limits specified network traffic but does not prevent local malicious behavior or every possible network path.
For an application that only needs to be prevented from initiating internet connections, start with an outbound rule. Add other restrictions only when justified.
Usually, local features may continue working, but some apps require network access for licensing, assets, authentication, or local-device discovery.
Open Windows Defender Firewall with Advanced Security > Outbound Rules, find the rule by its documented name, and disable or delete it. Disabling is preferable for initial testing because it preserves the rule for future use. Retest the application after restoring connectivity.
Free · no account needed · tracks your progress