A program is added to the Windows Firewall exceptions list even if you choose to block the program

Consider the following scenario. The following conditions are true:

• You are logged on to a computer that is running one of the following operating systems:
  • Microsoft Windows XP with Service Pack 2 (SP2)
  • Microsoft Windows Server 2003 with Service Pack 1 (SP1)
• You are logged on to a computer by using a domain user account that has no administrative rights.
• You start a program that listens on a port.

After you start the program that listens on a port, a Windows Firewall notification dialog box appears. The Windows Firewall notification dialog box has a Do not display the message after this program check box. You click to select the Do not display the message after this program check box, and then click OK. After you click OK, the program that listens on a port is added to the exceptions list. The exceptions list is located in the Programs and Services box on the Exceptions tab in the Windows Firewall dialog box. However, the program that listens on a port is not checked, and the program that listens on a port appears unavailable.

This behavior is by design.

When Windows Firewall detects a program that is trying to listen for traffic, Windows Firewall always adds the program to the list of possible exceptions. Windows Firewall adds the program to the list of possible exceptions unless you click Ask me later. If you click Ask me later, Windows Firewall stops prompting you for permission. If you choose to block the program, the program is added to the Windows Firewall exceptions list but remains unchecked. Because the blocked program is in the exceptions list, you could allow the blocked program in the future.