Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i enabled my windows 7 firewall to by default block all outbound connections by default. i configure each and every program that needs network access in the 'Windows Firewall with Advanced Security' mmc. problem is sometimes i cant find the program that needs network access. i enabled firewall logging but that log file does not contain the PID of the process that was blocked.

2010-08-26 17:57:33 DROP TCP 64883 80 0 - 0 0 0 - - - SEND
2010-08-26 17:57:33 DROP TCP 64884 80 0 - 0 0 0 - - - SEND
2010-08-26 17:58:10 DROP TCP 64885 80 0 - 0 0 0 - - - SEND

i know that this connection is triggered by the Games for Windows Live process, but allowing that specific executeable to go through the firewall does not prevent these connections from being dropped. how do i find out what actual program (or service) is trying to open up these connections, so i can make a firewall rule to allow it?

share|improve this question

Three years late, but still, if anyone needs to know, my solution would be one of the following:

  1. program that installs its own firewall driver with notification functionality (NetLimiter, Comodo Firewall)
  2. program that enables audit logging of blocked connections into security log (WFNotifier, WFControl)
  3. auditpol /set /subcategory:{0CCE9226-69AE-11D9-BED3-505054503030} /failure:enable
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.