1

I need to remove a lot of metro app related firewall rules in Windows 10 with powershell. It seems very slow compared to netsh or regedit. Anyway to speed it up?

# clean firewall rules, deleting profile doesn't get rid of them

# string (sid) 45 in length, no existing profiles
# 9000 rules take about 90 minutes to delete    

$profiles = get-wmiobject -class win32_userprofile

# I'm only dumping to a file to convert pscustomobject to string for sort
get-netfirewallrule -all | select-object -property owner > out

$list = get-content out | sort-object | get-unique | where-object { $_.trim().length -eq 45  -and $profiles.sid -notcontains $_ }

foreach($i in $list) {$i 
  remove-netfirewallrule -owner $i}

# about 65 rules per user here
echo ConfigurableServiceStore
get-netfirewallrule -all -policystore configurableservicestore | select-object -property owner > out

$list = get-content out | sort-object | get-unique | where-object { $_.trim().length -eq 45  -and $profiles.sid -notcontains $_ }

foreach($i in $list) {$i 
  remove-netfirewallrule -policystore configurableservicestore -owner $i}
0

4 Answers 4

3

EDIT: I've updated Select-Object -Property Owner to Select-Object -ExpandProperty Owner this way $_ contains only the Owner property:

$SID = (get-wmiobject -class win32_userprofile).SID

Write-Host "Getting Firewall Rules"
$Rules = Get-NetFirewallRule -All | Select-Object -ExpandProperty Owner -Unique | Where-Object { $SID -notcontains $_ }

Write-Host "Getting Firewall Rules from ConfigurableServiceStore Store"
$ConfigurableServiceStore = Get-NetFirewallRule -All -PolicyStore ConfigurableServiceStore | Select-Object -ExpandProperty Owner -Unique | Where-Object { $SID -notcontains $_ }

Write-Host "Deleting Firewall Rules:" -ForegroundColor Green
foreach($Owner in $Rules) {
    Write-Host "Deleting Rules with Owner: $Owner"
    Remove-NetFirewallRule -Owner $Owner
}

Write-Host "Deleting Firewall Rules from ConfigurableServiceStore Store:" -ForegroundColor Green
foreach($Rule in $ConfigurableServiceStore) {
    Write-Host "Deleting Rules with Owner: $Owner"
    Remove-NetFirewallRule -PolicyStore ConfigurableServiceStore -Owner $Owner
}
5
  • Thanks so much for your help. That script has some bugs though since you're using objects instead of text. $_..length becomes $_.owner.length, $_ becomes $_.owner, $i becomes $i.owner. And -policystoresource should be -policystore. I took out the check for 45 char since sometimes it's 44 char. As long as the profile doesn't exist I should be good. I deleted 4315 rules in 14.29 min. Not great but I think better than before. You can test this yourself by creating an account in win10 and logging in. Then as admin delete the profile using the system control panel. The 80 or so rules stay.
    – js2010
    Nov 17, 2016 at 23:38
  • I've updated my original solution, just using ExpandProperty fixes the need for $_.Owner :) I also changed a few var names for readability too. Nov 18, 2016 at 9:20
  • You can actually get rid of "| Select-Object -ExpandProperty Owner -Unique" and then just do "$Rules | remove-netfirewallrule". Not sure if it's more efficient. At least you get an ETA of the whole thing. Still seems slower than netsh to me.
    – js2010
    Nov 18, 2016 at 15:43
  • It's much faster deleting the corresponding registry entry. Luckily the firewall rule and the registry entry have the same name.
    – js2010
    Nov 18, 2016 at 23:19
  • Pretty cool. I can pass in the name member from the firewall object to remove-itemproperty. select-object is only a precaution. $rules2 | select-object -property name | remove-itemproperty -path ` "HKLM:\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System"
    – js2010
    Nov 21, 2016 at 20:11
2

Thanks for your help, but Remove-NetFireWallRule is just impractical (slow) in this case. To me the only solution is to use remove-itemproperty (registry) instead.

Here's the current script I'm using: (I went a little crazy with the progress bar).

The difference is one hour vs days. I could be deleting 10,000 - 100,000 firewall rules!

EDIT: In newest versions of Windows 10:

HKLM:\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System

has been changed to:

HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules

and cannot be retrieved by get-netfirewallrule.

EDIT2: If that AppIso registry entry gets too big, the search and start menu break.

$profiles = get-wmiobject -class win32_userprofile

Write-Host "Getting Firewall Rules"

# deleting rules with no owner would be disastrous
$Rules = Get-NetFirewallRule -All | 
  Where-Object {$profiles.sid -notcontains $_.owner -and $_.owner }

Write-Host "Getting Firewall Rules from ConfigurableServiceStore Store"

$rules2 = Get-NetFirewallRule -All -PolicyStore ConfigurableServiceStore | 
  Where-Object { $profiles.sid -notcontains $_.owner -and $_.owner }

$total = $rules.count + $rules2.count
Write-Host "Deleting" $total "Firewall Rules:" -ForegroundColor Green

$result = measure-command {

  # tracking
  $start = Get-Date; $i = 0.0 ; 
  # $total = $rules.Count

  foreach($rule in $rules){

    # action
    remove-itemproperty -path "HKLM:\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" -name $rule.name

    # progress
    $i = $i + 1.0
    $prct = $i / $total * 100.0
    $elapsed = (Get-Date) - $start; 
    $totaltime = ($elapsed.TotalSeconds) / ($prct / 100.0)
    $remain = $totaltime - $elapsed.TotalSeconds
    $eta = (Get-Date).AddSeconds($remain)

    # display
    $prctnice = [math]::round($prct,2) 
    $elapsednice = $([string]::Format("{0:d2}:{1:d2}:{2:d2}", $elapsed.hours, $elapsed.minutes, $elapsed.seconds))
    $speed = $i/$elapsed.totalminutes
    $speednice = [math]::round($speed,2) 
    Write-Progress -Activity "Deleting rules ETA $eta elapsed $elapsednice loops/min $speednice" -Status "$prctnice" -PercentComplete $prct -secondsremaining $remain
  }


  # tracking
  # $start = Get-Date; $i = 0 ; $total = $rules2.Count

  foreach($rule2 in $rules2) {

    # action  
    remove-itemproperty -path "HKLM:\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System" -name $rule2.name

    # progress
    $i = $i + 1.0
    $prct = $i / $total * 100.0
    $elapse = (Get-Date) - $start; 
    $totaltime = ($elapsed.TotalSeconds) / ($prct / 100.0)
    $remain = $totaltime - $elapsed.TotalSeconds
    $eta = (Get-Date).AddSeconds($remain)

    # display
    $prctnice = [math]::round($prct,2) 
    $elapsednice = $([string]::Format("{0:d2}:{1:d2}:{2:d2}", $elapsed.hours, $elapsed.minutes, $elapsed.seconds))
    $speed = $i/$elapsed.totalminutes
    $speednice = [math]::round($speed,2) 
    Write-Progress -Activity "Deleting rules2 ETA $eta elapsed $elapsednice loops/min $speednice" -Status "$prctnice" -PercentComplete $prct -secondsremaining $remain
  }
}

$end = get-date
write-host end $end 
write-host eta $eta

write-host $result.minutes min $result.seconds sec
0

If there are too many firewall rules for rule#2 to take care of, you get out of storage errors on server 2016.

Deleting the registry keys first and using this script for maintenance after the fact would fix it.

1
  • 2
    Please edit and rephrase this into a more assertive answer, which avoids the impression of being mostly "Thanks" (which is not considered an answer here). You can make this a decent answer if you predict the problem and propose your solution. Ideally you can support your proposal by tests or other research. At leat it is an answer then, currently you risk being deleted for "Not An Answer" reason.
    – Yunnosch
    May 3, 2020 at 7:44
0

If u cant't open the Regitry Path "System" below HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable. Delete the "Configurable" folder (automatic recreation).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.