Otdfbt

I know that the following cmd can enable file and print sharing firewall rule:

netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=yes

But it turns on file and print sharing for all profiles.

I'd like to only enable it for private profile, i.e. when the windows PC/laptops are connected to home or work network. I especially try to avoid turn it on for laptops connected to public network. Ideally Network discovery should be turned off for public network.

I've tried

netsh advfirewall firewall set rule group=”File and Printer Sharing” profile=private new enable=Yes

and 'profile' switch is rejected. So how can I apply the firewall rule selectively?

many thx for any input..

You are activating a preset rule, and I am guessing that the preset rule has Profile=any in it.

Try this first:

netsh advfirewall firewall set rule group="File and Printer Sharing" new profile=private

netsh advfirewall firewall set rule name="File and Printer Sharing (SMB-In)" dir=in profile=public|private|domain new enable=Yes|No

To set three profiles together at one time, use：

netsh advfirewall firewall set rule name="File and Printer Sharing (SMB-In)" dir=in new enable=Yes

The rule name must be changed in your local language, for example：

netsh advfirewall firewall set rule name="檔案及印表機共用 (SMB-In)" dir=in profile=private new enable=Yes

Don't forget to run as an administrator.

Circling around the subject there are rare cases when using local language names doesn't work, ie. Polish Udostępnianie plików i drukarek (SMB — ruch przychodzący) = File and Printer Sharing (SMB-In). I believe this has something to do with UTF-8 handling in netsh as there are reports that using netsh for connecting to UTF-named wifi networks sometimes doesn't work too.

In those cases use PowerShell's Set-NetFirewallRule and language-agnostic "Name" parameter (in this very case FPS-SMB-In-TCP). Use Get-NetFirewallRule command to get all the correct names for your rules.

Type this in an elevated powershell prompt :

Set-NetFirewallRule -DisplayGroup "File And Printer Sharing" -Enabled True -Profile Private

It worked for me on Windows 10 1703

Building on @Mulder's answer, to enable it for private mode, it needs to be set specifically for each rule in "Windows Defender Firewall with Advanced Security".

To run Windows Defender Firewall with Advanced Security

"C:WINDOWSsystem32mmc.exe" "C:WINDOWSsystem32wf.msc" 

To allow access for File/Print only on private network

Run the following in an Administrative Powershell window.

# Allow access to administrative shares through firewall [Ref: https://serverfault.com/a/739272]
netsh advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv4-In)" dir=in profile=private new enable=Yes
netsh advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv6-In)" dir=in profile=private new enable=Yes
netsh advfirewall firewall set rule name="File and Printer Sharing (LLMNR-UDP-In)" dir=in profile=private new enable=Yes
netsh advfirewall firewall set rule name="File and Printer Sharing (NB-Datagram-In)" dir=in profile=private new enable=Yes
netsh advfirewall firewall set rule name="File and Printer Sharing (NB-Name-In)" dir=in profile=private new enable=Yes
netsh advfirewall firewall set rule name="File and Printer Sharing (NB-Session-In)" dir=in profile=private new enable=Yes
netsh advfirewall firewall set rule name="File and Printer Sharing (SMB-In)" dir=in profile=private new enable=Yes
netsh advfirewall firewall set rule name="File and Printer Sharing (Spooler Service - RPC)" dir=in profile=private new enable=Yes
netsh advfirewall firewall set rule name="File and Printer Sharing (Spooler Service - RPC-EPMAP)" dir=in profile=private new enable=Yes