The rule blocks the app perfectly on your home Wi-Fi. Then the laptop goes to the office or a cafe hotspot and the same app is online again. Nothing broke — your rule only covers one kind of network. Windows calls them profiles, and there are three.
Windows Firewall keeps three separate rulebooks: Domain (office networks with a company server), Private (your home or trusted network) and Public (cafes, airports, unknown Wi-Fi). Every rule says which profiles it belongs to. A rule created for one profile politely does nothing on the others — and that is exactly the "works at home, fails outside" mystery.
Open wf.msc — the main Windows Defender Firewall with Advanced Security page shows the active profile in bold at the top of the overview. Or in PowerShell:
Get-NetConnectionProfile
The NetworkCategory column tells you Public or Private for your current connection. If Windows asks "make this device discoverable" on a new network, answering Yes sets Private and No sets Public — that innocent question is the profile switch.
wf.msc → Outbound Rules, double-click your block ruleFrom the command line, the same repair is one command:
netsh advfirewall firewall set rule name="Block MyApp" new profile=any
And when creating rules, the habit that prevents this whole problem: never untick a profile on the wizard's Profile page unless you truly mean it.
The Domain profile activates only when a work laptop is joined to a company domain and can reach its domain controller. Two honest consequences: at the office, company policy rules may sit above yours — an IT department can push rules that merge with or override local ones, and a local block can exist yet lose. That is not a fault; on a managed PC the admin's rulebook wins by design. On your own PC, Domain simply never activates and Private/Public do all the work.
Yes — and this surprises people in the other direction. Windows Firewall rules are machine-wide: a block you create applies no matter which user account is signed in — children, guests, everyone. There is no official per-user program rule in Windows Firewall. If accounts must have different access, that needs extra software or separate PCs; the firewall itself treats the machine as one unit. One related trap: a program installed per user lives under that user's AppData folder — its path contains a username, and the rule still works, but only for that copy of the program.
Watch the video for rule creation — then use this page to make the rule travel with the laptop.
▶️ Watch Full VideoIt only means Windows classifies it as untrusted. You can change it: Settings → Network and internet → your connection → set network profile to Private. Or simply make your block rule cover all three profiles and never think about it again.
Rule creation tools tend to default to the profile that is active at that moment. That is why checking the profile page — or the Advanced tab of the finished rule — is a habit worth having.
Not with Windows Firewall alone. Its rules apply to the whole machine and every account on it. Per-user control needs third-party tools or separate devices.