A software folder contains fifteen .exe files — the main program, helpers, updaters, tools. Blocking them one by one through the wizard is an afternoon gone. Honest answer first: the firewall cannot block a folder. But a short PowerShell loop can create all fifteen rules for you.
Let us be straight before any commands: Windows Firewall has no "block this folder" option. A program rule names one file, always. Anyone promising a folder rule is selling something. The real solution is automation — a PowerShell loop that finds every .exe in the folder and creates one properly named rule per file. It takes longer to read this page than to run the script.
Every firewall program rule stores one program path. There is no wildcard like C:\Apps\* and no folder scope for programs — the GUI will not even accept it. That design is actually sensible: Windows always knows exactly which file a rule governs. The cost is manual work for multi-file apps, and a loop pays that cost once.
Open PowerShell as administrator, paste this block, and change only the folder path in the first line:
$folder = "C:\Program Files\MyApp"
Get-ChildItem -Path $folder -Filter *.exe -Recurse | ForEach-Object { New-NetFirewallRule -DisplayName ("BlockFolder-" + $_.Name) -Direction Outbound -Program $_.FullName -Action Block }
-Recurse includes subfolders — remove it if you want only the top folderBlockFolder- — this matters for cleanup laterOpen wf.msc → Outbound Rules and sort by name. You should see your BlockFolder- rules in a neat block, one per file. Spot-check two things: the count roughly matches the number of .exe files in the folder, and one rule's program path (double-click → Programs and Services) is a real full path.
Because every rule shares a prefix, removing them all is one command in administrator PowerShell:
Get-NetFirewallRule -DisplayName "BlockFolder-*" | Remove-NetFirewallRule
And the honest trap to remember: this is a snapshot. Files the app adds later — especially a new version installed into the same folder — are not covered until you run the loop again. If the app escapes after an update, re-run the script; it simply adds rules for the new files alongside the old ones.
Watch the video for the single-app method first — this script is that same rule, written fifteen times by a loop.
▶️ Watch Full VideoFar more than this. Offices run thousands of rules. A folder with dozens of exes adds a negligible load — do not worry about performance here.
Yes. The loop does not care where the folder lives — give the full path, including portable and USB locations. Note that a USB drive letter can change, which changes paths and breaks the rules.
Yes — combine this with the scoped rule trick in this series: instead of plain rules, scope the block to public internet addresses only. The loop creates the rules; the scope ranges are added on each rule's Scope tab or via remoteip in the command.