如何创建仅影响单个本地账户的Windows防火墙规则？

Hey, I’ve been in this exact spot before—trying to lock down a firewall rule to only apply to a single local user, and scratching my head over what to plug into -LocalUser. Let’s break this down simply:

What values work for -LocalUser #

For local accounts, the parameter accepts two reliable formats:

• Fully qualified local username: Use either .\Username (the dot is a shortcut for your local machine) or YourComputerName\Username
• User’s Security Identifier (SID): This is a unique, unchanging string tied to the account—great if you want to avoid issues if the username ever gets modified

How to grab the SID (if you prefer that route) #

If you want to use the SID instead of the username, run this PowerShell command to fetch it for your target user:

Get-LocalUser -Name "YourLocalUsername" | Select-Object SID

Copy the resulting SID string (it’ll look something like S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-1001) and use that in your rule.

Full working examples #

Here’s how your firewall rule would look with each format:

1. Using the .Username shortcut:

New-NetFirewallRule -DisplayName "BLOCKWWW" -Direction Outbound -LocalPort 80,443 -Protocol TCP -Action Block -LocalUser ".\JohnDoe"

2. Using the full computer name + username:

New-NetFirewallRule -DisplayName "BLOCKWWW" -Direction Outbound -LocalPort 80,443 -Protocol TCP -Action Block -LocalUser "MYDESKTOP\JohnDoe"

3. Using the SID (with a variable for convenience):

$targetUserSID = (Get-LocalUser -Name "JohnDoe").SID.Value
New-NetFirewallRule -DisplayName "BLOCKWWW" -Direction Outbound -LocalPort 80,443 -Protocol TCP -Action Block -LocalUser $targetUserSID

Quick sanity checks #

• Always run PowerShell as an administrator—firewall rule changes require elevated privileges to apply
• To confirm the rule was set up correctly, run:

Get-NetFirewallRule -DisplayName "BLOCKWWW" | Select-Object DisplayName, LocalUser

You should see your target user or SID listed under the LocalUser property.

内容的提问来源于stack exchange，提问作者Lemonek