Fix for Windows Error: "Firewall does not allow exceptions; WinRM cannot be setup for remote access."

Description of the Error

This error occurs when you try to enable or configure Windows Remote Management (WinRM) using commands like winrm quickconfig or Enable-PSRemoting, but the Windows Defender Firewall is strictly configured to disallow any firewall exceptions.

In Windows Network security, there is a global or profile-specific setting that forces the firewall to block all inbound connections, completely ignoring any specific inbound rules or exceptions you have created. Because WinRM requires opening specific inbound ports (HTTP port 5985 and HTTPS port 5986) to allow remote management traffic, it fails immediately when this restrictive firewall override is active.

Step-by-Step Fix

To resolve this issue, you must disable the setting that blocks all exceptions in the Windows Firewall. Follow these step-by-step instructions:

Method 1: Using the Graphical User Interface (GUI)

1. Open the Control Panel:

   • Press the Windows Key + R on your keyboard to open the Run dialog box.
   • Type control and press Enter.

2. Navigate to Firewall Settings:

   • In the Control Panel, set the "View by" option in the top right corner to Large icons or Small icons.
   • Click on Windows Defender Firewall.

3. Change Notification Settings:

   • In the left-hand menu pane, click on the link that says Change notification settings (or Turn Windows Defender Firewall on or off).

4. Uncheck the Block Exceptions Option:

   • Look at your active network profiles (usually Private network settings and Public network settings).
   • Find the checkbox labeled "Block all incoming connections, including those in the list of allowed apps".
   • Uncheck this box for the network profile you are currently using (it is recommended to uncheck it for Private networks where you intend to use WinRM).

5. Apply Changes:

   • Click the OK button at the bottom of the window to save your settings.

6. Retry WinRM Setup:

   • Open an elevated Command Prompt or PowerShell (Run as Administrator) and run your WinRM configuration command again:

     winrm quickconfig

Method 2: Using Windows PowerShell (Fastest)

If you prefer using the command line, you can instantly fix this behavior by changing the firewall profile configuration via PowerShell.

1. Open PowerShell as Administrator:

   • Right-click the Start button or press Windows Key + X.
   • Select Windows PowerShell (Admin) or Terminal (Admin).

2. Check the Current Firewall Configuration (Optional):

   • Run the following command to see if inbound connections are being blocked globally:

     Get-NetFirewallProfile | Select-Object Name, InboundManagerPolicy

   • If it says BlockAllInbound, exceptions are being ignored.

3. Change the Policy to Allow Exceptions:

   • Run this command to change the inbound traffic deployment policy back to default, which allows configured exceptions:

     Set-NetFirewallProfile -Profile Domain,Private -InboundManagerPolicy Default

   • Note: If you are configuring this on a public network (not recommended for WinRM), you can add Public to the profile list, though keeping WinRM limited to Domain and Private networks is safer.

4. Configure WinRM:

   • Now that the firewall allows exceptions, execute the setup command:

     Enable-PSRemoting -Force

Method 3: Using Group Policy (For Domain Environments)

If this error occurs on a computer that belongs to a corporate domain, the setting might be enforced by a system administrator via Group Policy Object (GPO).

1. Open Group Policy Editor:

   • Press Windows Key + R, type gpedit.msc, and press Enter.

2. Navigate to Firewall Settings:

   • Go to: Computer Configuration -> Administrative Templates -> Network -> Network Connections -> Windows Defender Firewall.

3. Modify the Profile Settings:

   • Open either Domain Profile or Standard Profile depending on your network setup.
   • Look for the policy named "Windows Defender Firewall: Do not allow exceptions".
   • Double-click it, set it to Disabled or Not Configured, and click OK.

4. Update Policies:

   • Open Command Prompt as Administrator and run gpupdate /force to apply changes immediately.