Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to create a group, or add to an existing group, to a rule in Windows Advanced Firewall (preferable through a command prompt or WSH script).


enter image description here

share|improve this question

Rules in the Windows Firewall can be bundle together and activated or deactivated as a group.

With netsh advfirewall command you can add rules to the Firewall. Use the switch group= for manage the AdvFirewall groups.

Use something like this:

netsh advfirewall firewall set rule profile=domain group="Remote Desktop" new enable=Yes
share|improve this answer
Thank you. But, that tells me how to change an existing group. I want to know how to either add a group, or put one of my rules in an existing group. – frogstarr78 Oct 28 '11 at 2:34
With this commmand (Netsh advfirewall firewall set) you can create or change and existing rule and move it from its group. This works for what you need. Try it. – Ricardo Polo Oct 28 '11 at 3:01
Alright, so what's the syntax for creating a new group? I tried: netsh advfirewall firewall set rule Group="SmarterTools Administrative Interfaces" new and receive the error 'No rules match the specified criteria' – frogstarr78 Dec 24 '11 at 18:06
@RicardoPolo, sorry to tellyou, but the command to add a rule is netsh advFirewall firewall add rule... but none of the modifiers of this command allows to create a Group – XtianGIS Feb 10 '15 at 14:43

While you specifically mention

... through the command prompt

I'm gonna assume you mean using a script. With 2008, you can use powershell. Its pretty straightforward:

function Add-FirewallRule {
      $appName = $null,
      $serviceName = $null
    $fw = New-Object -ComObject hnetcfg.fwpolicy2 
    $rule = New-Object -ComObject HNetCfg.FWRule

    $rule.Name = $name
    if ($appName -ne $null) { $rule.ApplicationName = $appName }
    if ($serviceName -ne $null) { $rule.serviceName = $serviceName }
    $rule.Protocol = 6 #NET_FW_IP_PROTOCOL_TCP
    $rule.LocalPorts = $tcpPorts
    $rule.Enabled = $true
    $rule.Grouping = "@firewallapi.dll,-23255"
    $rule.Profiles = 7 # all
    $rule.Action = 1 # NET_FW_ACTION_ALLOW
    $rule.EdgeTraversal = $false


# Sample Usage
Add-FirewallRule "Test port 1234" "1234" $null $null
Add-FirewallRule "Test port 5555-6666" "5555-6666" $null $null
Add-FirewallRule "Test port 2222 Calc" 2222 "c:\windows\system32\calc.exe" $null
Add-FirewallRule "Test port 3333 W3SVC" 3333 $null "W3SVC"

See this article for more detail...

share|improve this answer
Windows 8 introduced native PowerShell cmdlets for managing Windows Firewall (; however, since this question is specifically about Windows Server 2008, your answer is likely the only option (apart from using netsh). – Massimo Mar 22 at 21:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.