This rule detects degradation of Windows Defender Firewall hardening by monitoring the registry for the DoNotAllowExceptions policy being set to 0 (DWORD 0x00000000). When DoNotAllowExceptions is 0, application and port exceptions are enabled, potentially restoring network paths blocked by a hardened profile. The detector watches registry edits under the FirewallPolicy path by matching a TargetObject that contains "\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\" and ends with "\\DoNotAllowExceptions" with a DWORD value of 0. It narrows the signal to svchost.exe processes via a filter and excludes certain main svchost instances to reduce noise. The rule is experimental with medium severity and is associated with defense-evasion concepts (ATT&CK T1686.003). It alerts on policy drift or misconfigurations that weaken firewall protection rather than routine changes.