Network profile switched to Public? Why Windows does it and how to stop it

After a restart, a Windows Server suddenly shows its domain network as Public, or a home PC calls the home network Public again. Remote Desktop stops answering, file shares disappear, monitoring goes quiet. The cause is almost always the same: Windows decided the network profile again, and decided wrong.

1. What the network profile does

Windows gives every network connection one of three network profiles (also called network location or network category):

Profile	When Windows uses it	Typical firewall effect
Domain	The computer is in an Active Directory domain and has reached a domain controller over this connection.	Rules for management, RDP, file sharing and monitoring usually allowed here.
Private	A network you trust, such as your home or office LAN, chosen by you or by policy.	Network discovery and sharing possible.
Public	Everything else, and every network Windows cannot identify.	The strictest set: the computer hides from the network, many inbound rules do not apply.

The Windows Firewall has one set of settings and rules per profile. A rule that is enabled only for Domain does not apply when the network is Public. That is why a profile change feels like an outage: nothing was blocked on purpose, the rules simply stopped applying.

The opposite happens too: a laptop that treats the hotel Wi-Fi as Private shows itself and its shares to everyone on it. See Is public Wi-Fi safe?

2. Check the profile

Get-NetConnectionProfile | Select-Object InterfaceAlias, Name, NetworkCategory, IPv4Connectivity

NetworkCategory is DomainAuthenticated, Private or Public. A domain member Server should show DomainAuthenticated on its LAN connection. In the Windows Firewall console, the active profile is marked on the overview page.

When did it change? The event log Applications and Services Logs › Microsoft › Windows › NetworkProfile › Operational records each connection to a network with the category Windows chose.

3. Why Windows picks Public

• The domain controller was not reachable when the network came up. Network Location Awareness tries to reach a domain controller as soon as the adapter is connected. If the network is not ready yet, DNS does not answer, or the domain controller itself is still starting (typical on a domain controller after a reboot), domain detection fails and the network falls back to Public. Windows does not always try again by itself.
• Wrong DNS servers. A domain member that also uses a public DNS server (for example 8.8.8.8 or the router) may not find the domain controller. Domain members should only use the domain's DNS servers.
• Unidentified network. A connection without a default gateway, or one Windows cannot recognise (a direct link, a backup or storage network, some VPN adapters), shows as Unidentified network and gets Public.
• A changed network. A new router, a new gateway MAC address or a re-created virtual switch makes Windows see a “new” network, and new networks start as Public.
• Something changed it on purpose. A setup program, a script, a VPN client or a policy can set the category.

4. Fix it

Private or Public: set it directly

Set-NetConnectionProfile -InterfaceAlias "Ethernet" -NetworkCategory Private

Run it in an elevated PowerShell; replace Ethernet with the InterfaceAlias from Get-NetConnectionProfile. On Windows 10 and 11 the same is in Settings › Network & internet › the connection › Network profile type.

Domain: let Windows detect it again

Set-NetConnectionProfile cannot set DomainAuthenticated: Windows only grants the Domain profile after it has reached a domain controller. Make it try again:

Restart-Service NlaSvc -Force
Get-NetConnectionProfile

If it stays Public, find out why the domain controller is not reachable:

Get-DnsClientServerAddress -AddressFamily IPv4   # only the domain's DNS servers?
nltest /dsgetdc:your.domain                       # is a domain controller found?
Test-ComputerSecureChannel                        # is the trust with the domain OK?

Unidentified networks

If a connection has no gateway on purpose (a storage, backup or cluster network), give it a gateway only if it really has one; otherwise decide what unidentified networks should be: Local Security Policy (secpol.msc) or Group Policy › Computer Configuration › Windows Settings › Security Settings › Network List Manager Policies › Unidentified Networks › Location type. Choose Private only for Servers whose unidentified networks are all internal.

Firewall rules that depend on one profile

Rules that must work whatever the profile, for example RDP restricted to your admin network, can be enabled for all profiles and limited by remote address. A rule scoped by address is safer than a rule that relies on the profile being right.

5. Keep it from happening again

Fixing the profile once is easy; the problem is that it comes back after the next restart or network change, and nobody notices until something stops working. Check the profile after every restart, or let a tool watch it.

Coinetic AI Security has a network profile lock, in every plan:

• Lock the profile of each network adapter (Domain, Private or Public) on the adapter's Configuration page.
• The protection service checks locked adapters at start, on every network change and every 30 seconds. A locked Private or Public profile is set back at once.
• A locked Domain profile cannot be forced, because Windows only grants it after reaching a domain controller. Coinetic makes Windows detect the domain again by restarting Network Location Awareness (at most every 10 minutes), and tells you if it still fails, so you know to check DNS and the route to the domain controller.
• Every change Windows makes is reported as an alert (by e-mail if you like), so a Server never quietly runs with the wrong firewall rules.
• On a laptop, Protect public Wi-Fi (Privacy menu) sets a network to Public and locks it there.

And the rest of the network side: open ports with the program behind them, a security check with fixes you can undo, automatic bans of password guessers and port scanners, and an alert when something switches the firewall off. See the Windows Server hardening checklist.

More guides: all Coinetic guides.

Frequently asked

Why does my domain network show as Public after a restart?

Network Location Awareness tried to reach a domain controller before the network, DNS or the domain controller itself was ready, and fell back to Public. Restart the service with Restart-Service NlaSvc -Force and check that the computer uses only the domain's DNS servers.

Can I set a network to Domain with PowerShell?

No. Set-NetConnectionProfile sets only Private or Public. Windows grants the Domain profile itself, after it has reached a domain controller over that connection.

Is Public or Private safer?

Public is stricter: the computer hides from the network and fewer inbound rules apply. Use Private only for networks you trust, such as your home or office LAN.

What is an unidentified network?

A connection Windows cannot recognise, usually because it has no default gateway. Windows puts it on Public unless the Unidentified Networks policy says otherwise.

Where does Windows store the network profiles?

In the registry under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles, one key per known network; the value Category is 0 for Public, 1 for Private and 2 for Domain. Use the PowerShell commands above rather than editing it.