Incident
Accounting firm rolled out a new tax prep package across 15 workstations. Installer ran clean on every box. First time anyone launched the app: "Cannot connect to license server." Every workstation, same error. Vendor support did what vendor support always does — "check your firewall" — and hung up. Opening Windows Defender Firewall settings one workstation at a time through the RMM's remote session is slow and clicky, and we needed a faster way to confirm the firewall was actually the problem before we went port-hunting.
Troubleshooting approach
Network was fine — ping to the license server worked. Telnet to TCP 27000 timed out, which told us something was blocking inbound or outbound on that port. The question was WHERE. Could be Windows Defender Firewall on the endpoint, could be a perimeter firewall rule, could be the license server itself refusing connections. The fastest way to narrow it down is to take Windows Defender Firewall out of the loop for 30 seconds and see if the app connects.
- ping license server: success (network layer OK)
- telnet to port 27000: timeout (something is blocking)
- question: local firewall, perimeter, or server-side?
- fastest test: disable local firewall temporarily
Solution
Quick PowerShell toggle that disables all three firewall profiles (Domain, Private, Public), lets you test, then flips them back on. Runs through the RMM in under a second. We wrote it with a hard re-enable path and a visible status display so there's zero chance of walking away with a firewall left off.
$ErrorActionPreference = 'Stop'
<#
██╗ ██╗███╗ ███╗███████╗██╗ ██╗ █████╗ ██╗ ██╗██╗ ██╗
██║ ██║████╗ ████║██╔════╝██║ ██║██╔══██╗██║ ██║██║ ██╔╝
██║ ██║██╔████╔██║█████╗ ███████║███████║██║ █╗ ██║█████╔╝
██║ ██║██║╚██╔╝██║██╔══╝ ██╔══██║██╔══██║██║███╗██║██╔═██╗
███████╗██║██║ ╚═╝ ██║███████╗██║ ██║██║ ██║╚███╔███╔╝██║ ██╗
╚══════╝╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚══╝╚══╝ ╚═╝ ╚═╝
================================================================================
SCRIPT : Windows Firewall Toggle v1.0.3
AUTHOR : Limehawk.io
DATE : January 2026
USAGE : .\windows_firewall_toggle.ps1
================================================================================
FILE : windows_firewall_toggle.ps1
DESCRIPTION : Enables or disables Windows Firewall for all profiles
--------------------------------------------------------------------------------
README
--------------------------------------------------------------------------------
PURPOSE
Toggles Windows Firewall state for all profiles (Domain, Private, Public).
If firewall is ON, turns it OFF. If firewall is OFF, turns it ON.
DATA SOURCES & PRIORITY
1) Windows Firewall current state
2) Hardcoded values (defined within the script body)
REQUIRED INPUTS
None - script automatically detects current state and toggles.
SETTINGS
- Affects all firewall profiles: Domain, Private, Public
- Toggle behavior: ON -> OFF, OFF -> ON
BEHAVIOR
1. Queries current firewall state for all profiles
2. Determines if firewall is currently enabled or disabled
3. Toggles to opposite state
4. Verifies new state
PREREQUISITES
- Windows 10/11
- Admin privileges required
SECURITY NOTES
- No secrets in logs
- WARNING: Disabling firewall reduces system security
- Use with caution in production environments
EXIT CODES
- 0: Success
- 1: Failure
EXAMPLE RUN
[INFO] CURRENT STATE
==============================================================
Domain Profile : ON
Private Profile : ON
Public Profile : ON
[RUN] OPERATION
==============================================================
Firewall is currently ON
Turning firewall OFF...
[INFO] NEW STATE
==============================================================
Domain Profile : OFF
Private Profile : OFF
Public Profile : OFF
[OK] RESULT
==============================================================
Status : Success
Action : Firewall disabled
[OK] SCRIPT COMPLETED
==============================================================
--------------------------------------------------------------------------------
CHANGELOG
--------------------------------------------------------------------------------
2026-01-19 v1.0.3 Updated to two-line ASCII console output style
2026-01-14 v1.0.2 Fixed header formatting for framework compliance
2025-12-23 v1.0.1 Updated to Limehawk Script Framework
2025-11-29 v1.0.0 Initial Style A implementation
================================================================================
#>
Set-StrictMode -Version Latest
# ==== STATE ====
$errorOccurred = $false
$errorText = ""
# ==== ADMIN CHECK ====
$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
if (-not $isAdmin) {
Write-Host ""
Write-Host "[ERROR] PRIVILEGES REQUIRED"
Write-Host "=============================================================="
Write-Host "Script requires admin privileges."
Write-Host "Please relaunch as Administrator."
exit 1
}
# ==== GET CURRENT STATE ====
Write-Host ""
Write-Host "[INFO] CURRENT STATE"
Write-Host "=============================================================="
try {
$domainProfile = (Get-NetFirewallProfile -Name Domain).Enabled
$privateProfile = (Get-NetFirewallProfile -Name Private).Enabled
$publicProfile = (Get-NetFirewallProfile -Name Public).Enabled
$domainState = if ($domainProfile) { "ON" } else { "OFF" }
$privateState = if ($privateProfile) { "ON" } else { "OFF" }
$publicState = if ($publicProfile) { "ON" } else { "OFF" }
Write-Host "Domain Profile : $domainState"
Write-Host "Private Profile : $privateState"
Write-Host "Public Profile : $publicState"
# Determine overall state (if any profile is ON, consider firewall ON)
$isFirewallOn = $domainProfile -or $privateProfile -or $publicProfile
} catch {
$errorOccurred = $true
$errorText = "Failed to query firewall state: $($_.Exception.Message)"
}
if ($errorOccurred) {
Write-Host ""
Write-Host "[ERROR] QUERY FAILED"
Write-Host "=============================================================="
Write-Host $errorText
exit 1
}
# ==== TOGGLE FIREWALL ====
Write-Host ""
Write-Host "[RUN] OPERATION"
Write-Host "=============================================================="
try {
if ($isFirewallOn) {
Write-Host "Firewall is currently ON"
Write-Host "Turning firewall OFF..."
Set-NetFirewallProfile -All -Enabled False -ErrorAction Stop
$actionTaken = "Firewall disabled"
} else {
Write-Host "Firewall is currently OFF"
Write-Host "Turning firewall ON..."
Set-NetFirewallProfile -All -Enabled True -ErrorAction Stop
$actionTaken = "Firewall enabled"
}
} catch {
$errorOccurred = $true
$errorText = "Failed to toggle firewall: $($_.Exception.Message)"
}
if ($errorOccurred) {
Write-Host ""
Write-Host "[ERROR] TOGGLE FAILED"
Write-Host "=============================================================="
Write-Host $errorText
}
# ==== VERIFY NEW STATE ====
Write-Host ""
Write-Host "[INFO] NEW STATE"
Write-Host "=============================================================="
try {
$newDomainProfile = (Get-NetFirewallProfile -Name Domain).Enabled
$newPrivateProfile = (Get-NetFirewallProfile -Name Private).Enabled
$newPublicProfile = (Get-NetFirewallProfile -Name Public).Enabled
$newDomainState = if ($newDomainProfile) { "ON" } else { "OFF" }
$newPrivateState = if ($newPrivateProfile) { "ON" } else { "OFF" }
$newPublicState = if ($newPublicProfile) { "ON" } else { "OFF" }
Write-Host "Domain Profile : $newDomainState"
Write-Host "Private Profile : $newPrivateState"
Write-Host "Public Profile : $newPublicState"
} catch {
Write-Host "Warning: Could not verify new state"
}
Write-Host ""
if ($errorOccurred) {
Write-Host "[ERROR] RESULT"
} else {
Write-Host "[OK] RESULT"
}
Write-Host "=============================================================="
if ($errorOccurred) {
Write-Host "Status : Failure"
} else {
Write-Host "Status : Success"
Write-Host "Action : $actionTaken"
}
Write-Host ""
if ($errorOccurred) {
Write-Host "[ERROR] FINAL STATUS"
} else {
Write-Host "[OK] FINAL STATUS"
}
Write-Host "=============================================================="
if ($errorOccurred) {
Write-Host "Firewall toggle failed. See error above."
} else {
Write-Host "Firewall state has been toggled successfully."
if (-not $isFirewallOn) {
Write-Host "Firewall is now ENABLED for all profiles."
} else {
Write-Host "WARNING: Firewall is now DISABLED. System security reduced."
}
}
Write-Host ""
if ($errorOccurred) {
Write-Host "[ERROR] SCRIPT COMPLETED"
} else {
Write-Host "[OK] SCRIPT COMPLETED"
}
Write-Host "=============================================================="
if ($errorOccurred) {
exit 1
} else {
exit 0
}
Security note
This is a diagnostic tool. It is not a fix and it must not be left in the disabled state. The workflow is: toggle off, test app, toggle back on — in that order, same session, no walking away. Once you've confirmed the firewall is the culprit, build the proper inbound rule for the specific port the app needs and deploy that rule via GPO or RMM. Never ship a machine with the firewall disabled. The script prints the current profile state prominently before and after the change so you can eyeball it, and your RMM's output log gives you a paper trail.
Outcome
Ran the script on the first affected workstation, firewall dropped, launched the tax app, and it connected to the license server immediately. That told us the Windows firewall was the block — not the perimeter, not the server. Re-enabled firewall on that machine right away, then built an inbound rule allowing TCP 27000 and deployed it through the client's GPO. Every workstation picked up the rule at the next policy refresh, all 15 launched cleanly, no machines left with firewall off. Total diagnosis took roughly 30 seconds per box versus probably an hour of poking through Event Viewer logs.
- time to diagnose: 30 seconds
- root cause: Windows Defender blocking TCP 27000 outbound
- fix: GPO inbound rule for TCP 27000
- workstations fixed: 15 of 15