Windows Defender Firewall: Allow ICMP exceptions
Verified with Windows 11 25H2 — updated on July 10, 2026
Supported on: At least Windows XP Professional with SP2
Path in the GPO console
Computer Configuration\Administrative Templates\Network\Network Connections\Windows Defender Firewall\Standard Profile Description
Defines the set of Internet Control Message Protocol (ICMP) message types that Windows Defender Firewall allows. Utilities can use ICMP messages to determine the status of other computers. For example, Ping uses the echo request message. If you do not enable the "Allow inbound echo request" message type, Windows Defender Firewall blocks echo request messages sent by Ping running on other computers, but it does not block outbound echo request messages sent by Ping running on this computer. If you enable this policy setting, you must specify which ICMP message types Windows Defender Firewall allows this computer to send or receive. If you disable this policy setting, Windows Defender Firewall blocks all the listed incoming and outgoing ICMP message types. As a result, utilities that use the blocked ICMP messages will not be able to send those messages to or from this computer. If you enable this policy setting and allow certain message types, then later disable this policy setting, Windows Defender Firewall deletes the list of message types that you had enabled. If you do not configure this policy setting, Windows Defender Firewall behaves as if you had disabled it. Note: If any policy setting opens TCP port 445, Windows Defender Firewall allows inbound echo requests, even if the "Windows Defender Firewall: Allow ICMP exceptions" policy setting would block them. Policy settings that can open TCP port 445 include "Windows Defender Firewall: Allow file and printer sharing exception," "Windows Defender Firewall: Allow remote administration exception," and "Windows Defender Firewall: Define inbound port exceptions." Note: Other Windows Defender Firewall policy settings affect only incoming messages, but several of the options of the "Windows Defender Firewall: Allow ICMP exceptions" policy setting affect outgoing communication.
Registry
HKLM
SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Windows Defender Firewall: Allow ICMP exceptions
; State: Enabled
; Supported on: At least Windows XP Professional with SP2
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings]
"AllowOutboundDestinationUnreachable"=dword:00000000
"AllowOutboundSourceQuench"=dword:00000000
"AllowRedirect"=dword:00000000
"AllowInboundEchoRequest"=dword:00000000
"AllowInboundRouterRequest"=dword:00000000
"AllowOutboundTimeExceeded"=dword:00000000
"AllowOutboundParameterProblem"=dword:00000000
"AllowInboundTimestampRequest"=dword:00000000
"AllowInboundMaskRequest"=dword:00000000
"AllowOutboundPacketTooBig"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Windows Defender Firewall: Allow ICMP exceptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowOutboundDestinationUnreachable' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundSourceQuench' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowRedirect' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundEchoRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundRouterRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundTimeExceeded' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundParameterProblem' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundTimestampRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundMaskRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundPacketTooBig' -Value 0 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Windows Defender Firewall: Allow ICMP exceptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundDestinationUnreachable' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundSourceQuench' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowRedirect' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowInboundEchoRequest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowInboundRouterRequest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundTimeExceeded' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundParameterProblem' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowInboundTimestampRequest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowInboundMaskRequest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundPacketTooBig' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Windows Defender Firewall: Allow ICMP exceptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowOutboundDestinationUnreachable' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundSourceQuench' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowRedirect' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundEchoRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundRouterRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundTimeExceeded' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundParameterProblem' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundTimestampRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundMaskRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundPacketTooBig' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Windows Defender Firewall: Allow ICMP exceptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Windows Defender Firewall: Allow ICMP exceptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundDestinationUnreachable' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundSourceQuench' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowRedirect' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowInboundEchoRequest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowInboundRouterRequest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundTimeExceeded' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundParameterProblem' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowInboundTimestampRequest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowInboundMaskRequest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings' -Name 'AllowOutboundPacketTooBig' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Windows Defender Firewall: Allow ICMP exceptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowOutboundDestinationUnreachable' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundSourceQuench' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowRedirect' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundEchoRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundRouterRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundTimeExceeded' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundParameterProblem' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundTimestampRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowInboundMaskRequest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowOutboundPacketTooBig' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.