Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i enabled my windows 7 firewall to by default block all outbound connections by default. i configure each and every program that needs network access in the 'Windows Firewall with Advanced Security' mmc. problem is sometimes i cant find the program that needs network access. i enabled firewall logging but that log file does not contain the PID of the process that was blocked.

2010-08-26 17:57:33 DROP TCP 192.168.1.200 24.143.204.147 64883 80 0 - 0 0 0 - - - SEND
2010-08-26 17:57:33 DROP TCP 192.168.1.200 24.143.204.129 64884 80 0 - 0 0 0 - - - SEND
2010-08-26 17:58:10 DROP TCP 192.168.1.200 24.143.204.147 64885 80 0 - 0 0 0 - - - SEND

i know that this connection is triggered by the Games for Windows Live process, but allowing that specific executeable to go through the firewall does not prevent these connections from being dropped. how do i find out what actual program (or service) is trying to open up these connections, so i can make a firewall rule to allow it?

share|improve this question

1 Answer 1

Three years late, but still, if anyone needs to know, my solution would be one of the following:

  1. program that installs its own firewall driver with notification functionality (NetLimiter, Comodo Firewall)
  2. program that enables audit logging of blocked connections into security log (WFNotifier, WFControl)
  3. auditpol /set /subcategory:{0CCE9226-69AE-11D9-BED3-505054503030} /failure:enable
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.