Protecting the machine

Profiles, modes, and the panic switch

Monitor-only, Balanced, Strict, and Kiosk, plus block-everything — what each changes and when to reach for it.

5 min read · updated July 25, 2026

A profile is a starting posture, not a cage. It sets how aggressive enforcement is by default; individual rules you make always win over it. Switching profile never deletes your rules.

The four profiles

Profile	What it does	Good for
Monitor-only	Watches and records. Enforces nothing — your rules stay defined but stop applying.	The first day, and the 10-second test when something breaks.
Balanced	Your rules apply. Nothing else is blocked by default.	Almost everyone, almost always.
Strict	Your rules apply, and unknown programs are asked about before they connect.	A machine you want to keep tight, or a week of deliberate tuning.
Kiosk	Deny by default: only what you've explicitly allowed gets out.	Single-purpose machines — a till, a display, a lab box.

Kiosk is deny-by-default, so build the allow-list before you switch to it. Turning Kiosk on with an empty list cuts off Windows Update, time sync, and license validation along with everything else — including NetSecWall's own check-in.

Monitor-only is a diagnostic, not a setting

The most useful thing about Monitor-only is how quickly it answers one question: is this NetSecWall's fault? Flip to it and retest the broken thing. Works? A rule of yours did it. Still broken? It was never us — go look at DNS, the network, or the app itself.

Do this first, before reading the Rules tab. A 10-second check in Monitor-only beats 10 minutes of squinting at rules that turn out to be irrelevant.

Block everything

The panic switch cuts all outbound traffic immediately. It's the right response to “I think something is exfiltrating data right now” and the wrong response to almost everything else.

Anything mid-transfer dies instantly. No grace, no finish-the-upload.
Remote sessions drop — including the one you're using to reach that machine.
It stays on until you turn it off. It's not a timer.

Never use block-everything over Remote Desktop or SSH on a machine you cannot physically reach. You'll cut your own connection, and the block will still be in force when you try to come back.

The settings password

A password can gate Settings, pausing, quitting, and profile changes. The point is that someone using the machine cannot switch protection off. See Parental controls.

There is no recovery for it. It is not stored anywhere we can reach, and support cannot reset it. Write it down somewhere that is not the machine it protects.

What survives what

Action	Rules	History	Enforcement
Switch profile	kept	kept	changes
Pause monitoring	kept	gap while paused	stops
Quit the app	kept	gap unless the service is installed	Windows Firewall rules stay; WFP filters stop
Reboot	kept	kept	resumes
Uninstall	removed	left on disk	stops

That third row is the one that catches people: with the packet-filter engine, closing the app stops enforcement, because the filters live in the running process. The Windows Firewall engine writes real OS rules, which persist whether NetSecWall is running or not.

Still stuck? Open a support ticket — we reply within one business day.