Question WFC drops from Medium to Low filtering on wake/reboot when GlassWire is installed (despite Secure Profile enabled)

[Sephirothnight]

Hello,

I would like to report an unexpected behavior regarding Windows Firewall Control (WFC) when another network monitoring tool is present on the system.

My exact setup & reproduction steps:

WFC is installed with Medium filtering and Learning mode enabled.

The Secure Profile option is checked in WFC.

GlassWire (Free version, latest update) is installed exclusively for its network scanner and VirusTotal integration. GlassWire's own internal firewall feature is turned OFF.
The Issue:
Whenever the PC wakes up from sleep mode, or after a full system reboot, WFC unexpectedly drops its profile from Medium down to Low automatically. I have to manually switch it back to Medium every time.

It seems that even with WFC's "Secure Profile" protection checked, external background services or driver initialization from GlassWire during system wake/startup are able to disrupt WFC's state and force a fallback to the Low profile.

Is this a known limitation of how WFC handles external software interactions, or could the Secure Profile lockdown be improved to prevent third-party tools from overriding or destabilizing the active profile state?

Thank you for your support and insights.

 

[Bot]

Hello,

I would like to report an unexpected behavior regarding Windows Firewall Control (WFC) when another network monitoring tool is present on the system.

My exact setup & reproduction steps:

WFC is installed with Medium filtering and Learning mode enabled.

The Secure Profile option is checked in WFC.

GlassWire (Free version, latest update) is installed exclusively for its network scanner and VirusTotal integration. GlassWire's own internal firewall feature is turned OFF.
The Issue:
Whenever the PC wakes up from sleep mode, or after a full system reboot, WFC unexpectedly drops its profile from Medium down to Low automatically. I have to manually switch it back to Medium every time.

It seems that even with WFC's "Secure Profile" protection checked, external background services or driver initialization from GlassWire during system wake/startup are able to disrupt WFC's state and force a fallback to the Low profile.

Is this a known limitation of how WFC handles external software interactions, or could the Secure Profile lockdown be improved to prevent third-party tools from overriding or destabilizing the active profile state?

Thank you for your support and insights.

Assessment

This behavior cannot be confidently attributed to GlassWire without logs or a controlled test. Disabling GlassWire’s firewall feature may not disable all of its background services or network-monitoring components, so an interaction remains possible, but it is not proof that GlassWire is changing WFC’s profile.

WFC’s Secure Profile option generally protects the selected Windows Firewall profile from certain changes; it should not necessarily prevent another service, a Windows policy transition, a failed WFC service initialization, or a configuration reload from causing WFC to display or select a different filtering state.

Recommended troubleshooting

• Confirm that WFC and GlassWire are both fully updated, and record the exact WFC and GlassWire versions.
• Check whether WFC’s service is running correctly after boot and after resume. A delayed, failed, or restarted service could explain the profile change.
• Review WFC’s own logs and Windows Event Viewer around the time of the change. The relevant locations usually include Windows Firewall with Advanced Security logging and the Windows Filtering Platform events.
• Temporarily uninstall GlassWire, rather than only disabling its firewall feature, and test several reboot and sleep/resume cycles. This is a more reliable isolation test because monitoring components and drivers may still be loaded when the firewall interface is disabled.
• If the issue disappears, reinstall GlassWire without optional monitoring components if that is supported, then test again. If the issue remains, perform the same test with WFC’s Secure Profile disabled and re-enabled to determine whether the setting itself is involved.
• Check whether Windows is changing the active network profile after resume or boot. Network-category transitions can cause firewall policy behavior that looks like a WFC filtering-profile change.
• Avoid manually changing Windows Firewall policies with other firewall-management utilities while testing, as this can make the results inconclusive.

It would also be useful to verify whether WFC is actually changing its filtering mode, or whether only the displayed profile changes while the underlying Windows Firewall rules remain active. A screenshot of the WFC status before and after the event, together with the WFC logs and relevant Event Viewer entries, would be needed for a reliable determination.

At present, this should be treated as a possible compatibility or startup-order issue, not a confirmed GlassWire fault or a demonstrated failure of Secure Profile. The most useful next step is a controlled test with GlassWire completely removed, followed by submission of the collected logs to the WFC developer if the problem persists.

 

[Sephirothnight]

Thank you for the detailed feedback.

Just to clarify: I have already performed the exact isolation test suggested. When GlassWire is completely uninstalled, the issue disappears entirely, and WFC remains stable on the Medium profile through system reboots and wake-from-sleep cycles. The moment GlassWire is reinstalled (even with its internal firewall turned off), the problem instantly comes back.

Therefore, while it might be an initialization conflict or background service clash, the correlation and root cause pointing to GlassWire's persistent background components interfering with WFC's active state are clear in practice.

 

[Divine_Barakah]

May I ask why ur using both? Personally I'd stick to WFC alone.

 

[Sephirothnight]

GlassWire (Free version, latest update) is installed exclusively for its network scanner and VirusTotal integration.

 

[Jonny Quest]

GlassWire (Free version, latest update) is installed exclusively for its network scanner and VirusTotal integration.

And there is also a lot of good information displayed in GlassWire Traffic Monitor, as well as the Network Scanner.

I've used GlassWire on and off for about 5 years, and WFC on and off for about 3 years, but never ran them together. In the last ~6-8 months, I've just been using WFC.

I have 2 laptops that I thought I'd test to see if the same thing happened to me, with your same settings...but I also tried without enabling Secure Profile.
When I had Secure Profile disabled, yes, after a restart, it would go from Med Filtering to Low, on both laptops (image below). But when I enabled Secure Profile, the settings held, even after 3 restarts on both the laptops. I'm using F-Secure, and have the Firewall sensor disabled, FWIW.

edit: I had downloaded and installed the newest version of GlassWire v3.9.1102 and WFC is v6.32.0.0