Blocking outgoing traffic with Windows 10 Firewall for a specific Windows user

Question

First of all, I'm aware of the following three questions and the corresponding answers, but none of them answer my problem:

• How to block/disable internet for one user in Windows 7 while keeping internet access for other users?
• Is there a way to block all internet traffic for a user with windows firewall?
• Windows 10 Firewall: block all - allow windows update

I'm running Windows 10 Professional on a laptop (stand alone, not inside a domain), which is used by multiple users. Every user has its own Windows account, and usually the list of users does not change.

I would like to block all outgoing traffic for a specific Windows user using the Windows Defender firewall. I've created a rule which blocks everything (all programs, all protocols, all ports, all IP addresses, all three profiles), and this rule seems to work well (I actually only checked ping, Firefox and wget).

When I edit this rule, on the last tab there is the option to ignore this rule for a set of users, see the following image:

My intention was to add all users where outgoing traffic is allowed, and only omit the single user that is not allowed to have outbound connections. However, the rule does not seem to work the way I thought it would, and I have no clue why. As soon as I check the corresponding checkbox and enter a single user into the list, the rule seems to be ignored, and anybody can connect.

Any help with this issue is appreciated. Thanks.

Answer 1

I searched for more information (took me a while), but there seems to be little information on how this principals tab in the firewall rule properties dialog works. I finally found this technet post from 2014 where the author had the same problem. The solution is to also add all users that the rule should apply to into the upper list of this tab ("Authorized Users"):

Thus as soon as principal exceptions (= Windows users) for this rule are defined, it is required to also define the set of principals this rule should apply to in the first place. The rule seems to be ignored for anybody who is not in the authorized users list.

The settings in the above image are useless at this point. But when you add users to the top (authorized users) list, outbound traffic of those users will be blocked.

However, I was unable to find any official documentation from Microsoft on this tab. If anybody knows a link, please share – thanks.