Event if firewall modified?
Hello,
please tell me,
whether events are created,
while firewall modifications?
I want to see, which modifications are done by a new installed program.
Thank you
Erhy
May 3rd, 2011 3:53am
Hi,
This can be done by enabling security logging using the steps outlined below.
1.Click Start, All Programs, and Administrative Tools.
2.Select Windows Firewall with Advanced Security.
3.Click Windows Firewall Properties.
4.Click one of the profile tabs, such as Public Profile.
5.Click the Customize button within the Logging area.
6.Enable firewall logging from the dialog box that appears.
7.Click OK.
Once you enable security logging, information is written to a log file that is stored in the Windows directory.
Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
May 6th, 2011 2:25am
For me it looks, that if I enable the logging, log entries are made belonging the network connection,
but not on modifications of the rules.
I'm right?
Erhy
May 8th, 2011 3:36am
Hi Erhy,
If that modifications of the rules is what you want, there seems no direct way of such records of changes. One method is to monitor registry using one feature of
Process Explorer.
Regards,
Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
May 9th, 2011 5:21am
Hi Erhy,
If that modifications of the rules is what you want, there seems no direct way of such records of changes. One method is to monitor registry using one feature of
Process Explorer.
Regards,
Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
May 9th, 2011 5:21am
I hoped that might be possible with well configured audit.
I found a list of possible messages,
where some items are for logging modifications of the firewall:
Security audit events for Microsoft Windows Server 2008 and Microsoft Windows Vista
Please tell me, how turn on the options to have such logs.
Erhy
Free Windows Admin Tool Kit Click here and download it now
May 9th, 2011 8:47am
Hi,
The Excel shows Event ID which can be viewed via Event Viewer. Please click Start, type Event viewer and click.
Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
May 10th, 2011 2:33am
Of course, events and audits are able to visit with the Event viewer;
though certain event groups have to be enabled for logging.
I installed new software whereby a firewall rule was added,
but I could not find a corresponding event.
Erhy
Free Windows Admin Tool Kit Click here and download it now
May 10th, 2011 6:38pm