Firewall diagnostics

Script location and requirements

After installation, the script is available at %LOCALAPPDATA%\Programs\Sennheiser.FirmwareUpdater\resources\Get-FirewallDiagnostics.ps1.

Use Windows PowerShell 5.1 or later. Run the script from an elevated Administrator PowerShell or command prompt whenever possible. Elevated runs return complete computer-scoped Group Policy data.

Run the script

Use the following command:

powershell -ExecutionPolicy Bypass -File .\Get-FirewallDiagnostics.ps1

Optional: use -OutputDir <path> to set the report folder. If you omit it, the script writes to the current user's Desktop (%USERPROFILE%\Desktop).

Output files

The script writes two timestamped files to the output directory. Collect both files from the user's machine for analysis.

What the script checks

The report is organized into sections that each target a likely cause of dropped mDNS discovery.

• System:
  host name, user, OS build, and whether the script runs elevated.
• Firewall profiles (ActiveStore):
  DefaultInboundAction for each profile and whether AllowLocalFirewallRules is False, which means Group Policy ignores locally created rules.
• Group Policy firewall registry:
  HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall and AllowLocalPolicyMerge = 0, which means local rules are ignored.
• Network connection profiles and IPv4 addresses:
  each interface's NetworkCategory and connectivity, including link-local 169.254.* adapters. Windows classifies such networks as Public.
• Inbound BLOCK rules:
  enabled inbound block rules that match the Sennheiser executables or UDP 5353, and whether they come from Group Policy or local settings.
• All rules that touch UDP 5353:
  every rule that references the discovery port.
• Installer rules present:
  checks whether the four named Sennheiser rules exist.
• GPO-delivered rules (RSOP) and gpresult:
  the effective policy on the machine.
• Summary / verdict:
  a plain-language conclusion with flags and a recommended action.

Scope

The script diagnoses discovery only. It inspects rules that reference the Sennheiser executables and UDP 5353, but it does not examine UDP 45. If a device is discovered and listed but never becomes controllable, check UDP 45 separately for L 6000 chargers, and TCP 443 for EW-DX receivers.

Interpreting the verdict

Use the verdict flag to determine the next action.