Scoping Windows Defender Firewall rules with NetSecurity without locking out your own session

Goal

Add or tighten a Windows Defender Firewall rule from PowerShell without cutting off the very session (WinRM or RDP) being used to make the change.

Prerequisites

Administrator rights; the built-in NetSecurity module (present on Windows Server 2019/2022/2025); a second, independent way to reach the box (out-of-band console, or a second remoting session) before tightening anything broad.

Steps

1. Record current state before changing anything: Get-NetFirewallProfile -Name Domain,Private,Public | Select-Object Name,Enabled | Export-Clixml firewall-profiles-before.xml. Get-NetFirewallProfile "displays the currently configured options for a specified profile," matching the options on the Windows Firewall with Advanced Security properties page.
2. List what is currently allowed for the channel you care about: Get-NetFirewallRule -DisplayGroup "Windows Remote Management" -Enabled True | Select-Object DisplayName,Direction,Action,Profile.
3. Add a narrowly scoped rule instead of a broad allow: New-NetFirewallRule -DisplayName "Allow-WinRM-Mgmt-Subnet" -Direction Inbound -Protocol TCP -LocalPort 5986 -RemoteAddress 10.0.5.0/24 -Profile Domain -Action Allow. -RemoteAddress restricts the rule to the given source range and -Profile restricts it to the named network profile; both are documented parameters of New-NetFirewallRule.
4. Before removing or narrowing an existing broad rule, open a second connection using the new, narrower rule and confirm it works; only then retire the old one with Remove-NetFirewallRule.
5. Confirm the change: Get-NetFirewallRule -DisplayName "Allow-WinRM-Mgmt-Subnet" should return the rule; a connectivity test from an address inside the scoped range should succeed, and one from outside it should fail.

Expected result

The management port answers from the intended source range only, and the session used to make the change is unaffected because it was never removed until the replacement was verified.

Limits and test basis

On a domain-joined host, Group Policy–sourced firewall rules can take precedence over a local New-NetFirewallRule; check (Get-NetFirewallRule -DisplayName '...').PolicyStoreSourceType if a new rule appears to have no effect. To undo, Remove-NetFirewallRule -DisplayName "Allow-WinRM-Mgmt-Subnet" deletes exactly what step 3 added; restoring profile-level settings means reapplying the values captured in step 1 with Set-NetFirewallProfile. No reboot is required; rule and profile changes take effect immediately.