How to get rid of the red X in system tray when you disable Norton's Firewall

[NHP]

I don’t want to constantly see that red X there and the big red block saying “You are unprotected” every time I need to access the Norton options. How do I get rid of that?

[bjm]

@NHP

How to get rid of the red X in system tray when you disable Norton’s Firewall
I don’t want to constantly see that red X there and the big red block saying “You are unprotected” every time I need to access the Norton options. How do I get rid of that?

Hello @NHP
Norton Security/360 for Windows?
Respectfully, why disable Norton Smart Firewall?

When a red “X” appears directly on the Norton 360 system tray button, it means Norton’s internal status checker has registered that one of its core security features (such as the Firewall, Auto-Protect, or Antivirus) has been turned off or has encountered an error.

If you prefer to keep the firewall disabled and don’t want to look at the red X on your taskbar, you can hide Norton’s icon from the system tray entirely.

If you turned off the firewall because it was blocking a specific program, game, or network connection, it is much better for your security to turn the firewall back on and instead create an exception rule for that specific app. This keeps your PC protected while stopping Norton from interfering with what you are trying to do.

Are you trying to bypass Norton to fix a specific app connection or error?
Did you try Smart Firewall → Automatic Program Control → Ask

There is no setting inside the Norton software that will remove that red X badge from the system tray icon while a core protection like the Smart Firewall is turned off.

+++++++++++++++++++++++++++++++++++++++++++++

Unblock safe apps by temporarily turning off your Norton protection

Hide the Icon via Windows 11 Settings

1. Press the Windows Key + I to open the Windows Settings panel.
2. Select Personalization from the left-hand sidebar menu.
3. Click on Taskbar on the right side.
4. Scroll down and click to expand the Other system tray icons menu.
5. Locate Norton in the list of applications and toggle the switch to Off.

What this does: This forces Windows to strip the Norton icon completely off your visible taskbar/system tray and lock it away inside the hidden overflow menu (the small ^ arrow). The red X will still technically exist, but it will be 100% invisible during your normal desktop usage.

[NHP]

Last week all the firewall settings that were set to Blocked changed to Allowed. I have some older versions of software that I prefer that I don’t want updated to current versions and I almost lost one of them when I ran it, thankfully shut it down quick enough so it didn’t update. When I looked into why that happened is when I noticed all of the firewall settings were set to Allow. That’s a very serious flaw to me and I won’t be trusting Norton’s firewall again after that. Most other AV programs let you use Windows firewall without the red block of “You are unprotected” constantly there. I was hoping Norton had a way to do that as well. Hiding the icon to make it more difficult for me to access isn’t much of a fix.

[bjm]

@NHP

Last week all the firewall settings that were set to Blocked changed to Allowed. I have some older versions of software that I prefer that I don’t want updated to current versions and I almost lost one of them when I ran it, thankfully shut it down quick enough so it didn’t update. When I looked into why that happened is when I noticed all of the firewall settings were set to Allow. That’s a very serious flaw to me and I won’t be trusting Norton’s firewall again after that. Most other AV programs let you use Windows firewall without the red block of “You are unprotected” constantly there. I was hoping Norton had a way to do that as well. Hiding the icon to make it more difficult for me to access isn’t much of a fix.

Hello @NHP

LiveUpdate Core Updates: Regular antivirus definition updates won’t change your settings. However, when Norton pushes a version update via LiveUpdate, it replaces the underlying firewall engine driver. If the driver migration encounters an error, your custom rule database is discarded, and Norton resets to its factory default state (which is to “Allow” standard traffic).

Curious, have you tried:
Norton Smart Firewall – Automatic Network Control → Windows Settings Mode

Maybe, 26.7 to 26.8 version update caused your custom “Block” rules to change to “Allow.”

While normal daily definition updates won’t affect your settings, a core engine update can revert them due to three specific behaviors within Norton:

1. The Rule Migration Fails during Core Updates

When Norton LiveUpdate pushes a software update, it often reinstalls the underlying firewall driver entirely. During this replacement process, Norton tries to migrate your custom user profiles. If that data file is locked, deemed incompatible with the new engine version, or encounters a glitch during the install, Norton throws out the old rules and builds a brand-new configuration file. This blank configuration defaults back to the company’s factory settings, which means everything goes back to Allow.

2. Automatic Program Control Re-evaluates the Files

If you have Automatic Program Control toggled on, Norton continuously uses its cloud database to decide what programs are safe. After a major version update, Norton often re-scans the system executable files to re-register them with the new engine. If its cloud rating says your old programs are “Safe and Trusted,” the automation engine will actively overwrite your manual “Block” command and change it to “Allow” to prevent what it considers a “false positive” interruption.

3. Automatic Repair Protocols Triggers a “Firewall Reset”

Sometimes a version update doesn’t settle properly on the first reboot, causing Norton’s core background network service to crash. When Norton detects its firewall driver failing, a safety mechanism kicks in. To guarantee your computer doesn’t lose internet connectivity entirely due to a corrupted settings file, Norton resets the Smart Firewall back to its baseline default configuration, instantly turning your custom blocks into allows.

Maybe, try Windows Settings Mode and use the native Windows Defender Firewall to block those old programs:

• Microsoft updates almost never wipe out or overwrite your custom Windows Firewall rules (wf.msc).
• Because Windows separates its OS security configurations from third-party applications, a Norton update can completely crash, reinstall, or reset itself to factory settings, and it won’t affect the block rules you built inside Windows.

To permanently block those old programs through the native Windows Defender Firewall without worrying about Norton product updates (like the recent 26.7 to 26.8 release) wiping your rules, follow this two-step process:

Step 1: Set Norton to “Windows Settings Mode”

Before configuring Windows, you must tell Norton to stop managing application network connections.

1. Open the Norton dashboard.
2. Click Settings > Firewall.
3. Under the General Settings tab, locate Automatic Network Control.
4. Change the dropdown selection to Windows Settings Mode.
5. Click Apply and close Norton.

Step 2: Create Permanent Block Rules in Windows Firewall

Now, you will manually add a rule inside Windows to completely cut off internet access for each legacy app.

1. Open the Start Menu, type wf.msc, and press Enter to launch Windows Defender Firewall with Advanced Security. In the left-hand menu column, click once on Outbound Rules. (Outbound rules control what traffic is allowed to leave your computer).
2. Look at the right-hand Actions panel and click New Rule….
3. On the Rule Type screen, select Program and click Next.
4. Click the Browse… button next to “This program path” and navigate to the exact folder where your old program is installed. Select its primary .exe file, click Open, and then click Next.
5. On the Action screen, select Block the connection and click Next.
6. On the Profile screen, leave all three checkboxes (Domain, Private, Public) checked to ensure the app is blocked on all networks, then click Next.
7. Name the rule something clear (e.g., Block - Old Software Name) and click Finish.

Repeat Step 2 for any other old programs you want to restrict.

Why This Specific Method Works
By utilizing Windows Settings Mode, you have separated your custom security preferences from the third-party update engine. Even if Norton pushes an update next week that forces another system restart, it will look to the Windows database (wf.msc) for its logic. Microsoft will never alter or clear your custom list of blocks during software transitions

AI sourced content may make mistakes
Caveat: I don’t run Windows Settings Mode. I don’t run Block rules.

[NHP]

It would have been helpful had their update included a warning stating that.

It was set to Smart Mode for the Smart Firewall - Auto Network Control. I’m back to using Windows Firewall and really don’t want to risk Norton’s Firewall again. Those instructions sound like I would be running both firewalls from Windows and Nortons? I didn’t think that was something that should be done.

[SoulAsylum]

@NHP When installing ANY third party antiviral software on Windows, that software gets dedicated to performing the firewall and other malware protections vice Defender and Windows Firewall. Windows Firewall MUST remain active in system services ONLY for Windows Updates to work correctly. That is a requirement that Microsoft makes not Norton. Your Norton firewall handles all the traffic to and from your device as long as it is installed. One firewall doesn’t run on top of the other and create conflicts. Hope that helps clarify for you.

**Another issue of note is that when a new version release gets installed by Norton it will wipe previous settings every time. This isn’t a new issue and has been raised more than a few times across the forums.

AI Overview

When you install a third-party antivirus (AV) with its own firewall suite, Windows automatically disables the built-in Microsoft Defender Antivirus core protection and routes network security management through your third-party software. However, the native Windows Defender Firewall usually remains active in the background unless explicitly turned off or replaced by the third-party application. [1, 2, 3, 4]

Managing Windows Firewall and Third-Party AV

What Happens Automatically

• Antivirus Handshake: Installing a certified third-party AV shifts real-time scanning duties away from Windows Security, putting Defender into a passive or disabled state. [1, 2]

• Firewall Control: Some comprehensive security suites (like ESET, Bitdefender, or Norton) automatically disable the Windows Defender Firewall and enable their own firewall module. Others leave the Windows Firewall running alongside their application layer. [1]

How to Manually Turn Off Windows Firewall

If your third-party AV does not automatically turn off the native Windows Firewall and you need to disable it to troubleshoot a network issue:

• Open the Start Menu, type Windows Security, and open the app.

• Click on Firewall & network protection on the left menu (or home dashboard).

• Click on your currently active network profile (Domain network, Private network, or Public network).

• Toggle the Microsoft Defender Firewall switch to Off.

• Confirm the change by clicking Yes on the prompt. [1, 2, 3]

How to Manage the Third-Party AV Firewall

If you need to adjust or disable the firewall provided by your specific third-party antivirus instead of the Windows one:

• Look at the bottom-right taskbar corner (system tray) and find your antivirus icon.

• Right-click the icon to open the quick-access or shield control menu.

• Select Open [AV Name] or navigate to its Settings / Firewall module.

• Locate the firewall toggle or network shield setting and temporarily or permanently disable it based on your needs. [1]

If you haven’t seen this setting already you can have a look at it on your side to see what fits your specifics.

SA

[bjm]

@NHP

Those instructions sound like I would be running both firewalls from Windows and Nortons?

Okay…my understanding is that Windows Settings Mode hands off traffic to Windows Firewall.
Since, I don’t run Windows Settings Mode. I’ll defer to users that do run Windows Settings Mode.
Regards w Respect

EDIT: see ###

[NHP]

To get to that setting, I have to turn Norton’s Firewall on to change it. And then Windows Firewall has a message that the firewall is being managed by Norton. Sorry, not trusting what it’s going to do again, I’m leaving Norton’s Firewall off.

[bjm]

@NHP

To get to that setting, I have to turn Norton’s Firewall on to change it. And then Windows Firewall has a message that the firewall is being managed by Norton. Sorry, not trusting what it’s going to do again, I’m leaving Norton’s Firewall off.

Hello @NHP
Okay. Thanks for sharing your feedback.
I’m retracting my earlier suggestion of Windows Settings Mode.

• Windows Settings Mode: Follows the Windows Firewall settings for new network connections. When you select this option, Norton does not prompt you with any firewall alerts.
  https://support.norton.com/sp/en/us/norton-360-deluxe/26.8/solutions/v20240108181338560

After looking more closely at Norton’s documentation, I need to qualify my earlier suggestion of Windows Settings Mode.

My initial thought was based on Norton’s wording that Smart Firewall will “follow your Windows Firewall settings,” which made it sound like Windows Firewall could be used to manage the traffic rules while Norton remained enabled. The fuller documentation, however, specifically says Windows Settings Mode follows Windows Firewall settings “for new network connections.” Norton also separately documents Program Control as the mechanism for application-specific Allow/Block decisions.

So I don’t think we can say with confidence that a custom Windows Firewall outbound Block rule for one of your legacy programs will be enforced by Norton in Windows Settings Mode. That’s why I asked whether you had actually tried it.

Given what happened with your existing Norton Block rules, I completely understand why you’re not willing to turn Smart Firewall back on just to experiment. And I don’t think we should assume that the recent Norton update caused the Block → Allow change either. The timing makes it worth investigating, but we don’t yet know what actually caused those settings to change.

So, at this point, I’d call Windows Settings Mode something potentially worth exploring, but not a confirmed solution for your particular use case.

And I agree with you – not wanting to turn Smart Firewall back on just to experiment. Given that you found your manually configured Block settings had changed to Allow, I can understand why you’re not willing to put it back into service until you have confidence in what happened.

I also agree with your larger point: if you deliberately configured programs to Block, discovering later that those settings had changed to Allow is a serious enough issue to undermine confidence in the firewall. We don’t yet know what caused the change — the timing makes a Norton update worth investigating, but we shouldn’t claim that’s the cause without evidence.

My suggestion of Windows Settings Mode was based on the wording in Norton’s UI, but after looking at the fuller documentation, I agree it isn’t something I can tell you will provide the Windows Firewall program-level blocking you’re looking for. So I wouldn’t ask you to trust it without testing it, either.

I gave you advice that turned out to be insufficiently supported, and I’m owning that.

Regards w Apologies

[NHP]

Thank you though for trying, it was worth looking into. The only other option was a Windows update changing the settings? No one touches my PC except me and I know I didn’t change any settings within Norton recently at all, and nothing else new was installed recently. So I’ll just suffer with the X and seeing the “You are unprotected” and continue to use the Windows Firewall. Thanks again for trying to help out.

[bjm]

@NHP

Thank you though for trying, it was worth looking into. The only other option was a Windows update changing the settings? No one touches my PC except me and I know I didn’t change any settings within Norton recently at all, and nothing else new was installed recently. So I’ll just suffer with the X and seeing the “You are unprotected” and continue to use the Windows Firewall. Thanks again for trying to help out.

Hello @NHP

• August 11: Microsoft Patch Tuesday.
• “Last week”: OP notices the Norton Block → Allow changes.
• August 18: Norton 26.8 arrives.

So Windows Update is actually temporally plausible if the OP’s “last week” means around August 11–17. But, we have no evidence that a Windows update would rewrite Norton’s Program Control entries from Block to Allow.

And Norton 26.7 was released July 21, so that is also too early to neatly explain a change discovered last week unless the OP received some intervening Norton update or configuration event.

So I’d now say the OP has identified a genuinely unresolved event:

Something changed those Norton Program Control settings sometime last week, but based on the available timeline, we can’t simply blame Norton 26.8. Windows Update is a plausible coincident event, but there’s no evidence yet that it caused the Norton settings to change.

Which makes the OP’s decision to leave Smart Firewall off pretty understandable — especially since the root cause remains unknown.

Regards w Respect

[bjm]

Hello @NHP
I was wondering whether the legacy programs that you do not want updated – have an internal updater – e.g., abcupdate.exe
Maybe, you can rename abcupdate.exe to – e.g., abcupdate.exeNG and delete abcupdate.exe
for example:

Maybe, there’s a scheduled task you can disable.
for example:

[NHP]

I did look into that once, but it was safest to just block them (especially since I’m not interested in ads one of them pushes for their cloud storage that I’d never use). I’ll look into it again though to be sure I didn’t miss anything. But I’m pretty ok with it now going back to Windows Firewall full time.

[bjm]

@NHP

I did look into that once, but it was safest to just block them (especially since I’m not interested in ads one of them pushes for their cloud storage that I’d never use). I’ll look into it again though to be sure I didn’t miss anything. But I’m pretty ok with it now going back to Windows Firewall full time.

Thanks for sharing your progress