Ping to Windows 10 not working if "file and printer sharing" is turned off?

Question

I have one Windows 10 computer on a local network.

When I try to ping the Windows 10 machine from some other computer, it fails (Request timed out). From the Windows 10 machine, I can ping other devices with no problems.

I found out that if I go in Control Panel to the "Advanced sharing settings" and I turn on "File and printer sharing," the ping to this machine works normally.

My question is, WHY?

Why doesn't the ping work if "File and printer sharing" is turned off (on the pinged machine)? How is that related to the ping reply? A machine should still reply to a ping even if it does not share file/printer resources, or did I miss something?

Solution 1

Because the File and printer sharing settings include the ability to deny/allow ICMP traffic. You can actually see this by navigating to the following:

1. Click the Start button
2. Search for Windows Firewall
3. Select Advanced Settings on the left
4. In the left pane select Inbound Rules
5. In the right pane look for the rules titled File and Printer Sharing (Echo Request - ICMPv4-In)

(Source)

You can see an example from my laptop (with File and printer sharing turned on) directly below:

Taking it a step further, if you want to leave File and printer sharing off but still allow "pings," you can enable the appropriate rules shown within the red box in the picture.

Solution 2

I had issues ping-ing a Windows 10 VM, even if I turned on the file and printer sharing rule.

So I added the following:

netsh advfirewall firewall add rule name="ping" protocol=ICMPV4 dir=in action=allow

Warning: this command will apply the rule to the Private, Public, and Domain network profiles.

Solution 3

Often the issue can be fixed by moving your interface from PUBLIC to PRIVATE.

Windows assigns (or asks you to assign) network interfaces to either the PUBLIC or PRIVATE network profile. The firewall in windows is configured to allow pings from devices connecting via interfaces in the PRIVATE profile, but not from devices connecting via interfaces in the PUBLIC profile.

You can change the firewall configuration, but it may be easier to move your network interface (LAN, WIFI, etc) from PUBLIC to PRIVATE. This should do the trick.

As an example, for a WIFI interface, click on the wifi icon in the task bar and select the WIFI and properties. Then change the network profile from PUBLIC to PRIVATE.

Solution 4

"File and Printer Sharing" are a group of firewall rules, some of which also enable answering to the incoming ICMP echo requests sent by ping.

However, to enable ping only, you could also enable another pre-configured group of rules named "Core Networking Diagnostics".

These can all be enabled on the command-line, using netsh. The commands are quite cumbersome, but can be easily copy/pasted to re-use on other machines.

So, to enable ping only, enable the "Core Networking Diagnostics" group:

netsh advfirewall firewall set rule group="Core Networking Diagnostics" new enable=yes

To enable "File and Printer Sharing", which will also enable ping:

netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=yes

And to list all pre-configured inbound rules into a "firewall.txt" file in your user directory :

netsh advfirewall firewall show rule name=all dir=in > $HOME\firewall.txt

View more solutions

Comments

[lucidBug]

tnx! so basically, in windows, ICMPv4-In is directly connected with "file and printer sharing"? I cannot allow ICMPv4-In without "file and printer sharing" ?

[lucidBug]

*without turning ON "file and printer sharing"

[Run5k]

Settings that control ICMP traffic are included within the File and printer sharing functionality, but as I mentioned at the end of my answer, you should be able to individually enable the appropriate rules within Windows Firewall to allow ICMP traffic.

[lucidBug]

But if I enable the rule (the one in the red box), then this is same like I put ON "file and printer sharing"? or not?

[lucidBug]

a ok, if I keep the others off (SMB, Spooler, LLMNR) then nothing is shared. Right?

[Run5k]

If you only want to enable "ping" traffic, focus your efforts on the rules within the red box. You can allow it for just Private (as I did) or also allow Public, depending upon your personal preference and security posture.

[lucidBug]

one more thing. In linux the machine can be automatically, pinged. Why in Windows, the echo reply, is tied with "file and sharing"? Is there a reason why they did it in this way? Cause lof of people have the sharing thing turned off... and maybe not everyone knows that this thing is tied with echo reply.

[Run5k]

This was done to simplify things for the average end-user. The File and printer sharing functionality makes several changes when it is toggled on/off. Realistically, the average Windows end-user will never get into the firewall to specifically enable/disable rules, and they probably won't have a compelling need to "ping" devices on their network, either.

[lucidBug]

understand! tnx!

[Peter Bašista]

In my case, the network I am connected to is marked as private and yet Windows does not allow pings unless file and printer sharing is enabled. So, the network classification (i.e. private, public, etc.) and ping availability are not directly tied together.

[rkantos]

I think by default the file and printer sharing rules allow ICMP from the local subnet only thus if your VMs are in a NAT - you will need another rule.