# Does Windows Firewall have the ability to log which exe is blocked?

We would like to distribute a firewall program with our product.

I can configure the Windows Firewall to block outgoing connections (which it does not by default)

netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound

But then I need to know when one is blocked so it can ask if it should be unblocked.

I tried turning on logging, but it does not log the path to the exe. Is there a way to get that logged?

I posted a question on StackOverflow to try an event detection method, but if there was a way to turn on logging of the path to the exe, I wanted to know about it. I hope to stay with Java which is limited in event detection.

I don't mind calling any command-line programs, also don't mind using vbscripts. But what I need is to know as soon as an outgoing connection from an exe is blocked and which exe.

-
Is this a one-time thing for something you're testing, or something you need to know as a function of your program? I don't think the ability is built in to Windows firewall but there were third-party applications that did. – Bart Silverstrim Sep 28 '11 at 16:16
Whatever solution needs to be distributed with my program. It is not a one time thing. If there was a third-party program that I could control through the command-line it might be acceptable, but it is probably going to be necessary for us to control all the GUIs, and we do not want to have to pay for it. – George Bailey Sep 28 '11 at 18:07

I believe this is what you are looking for: application logging

Once this is configured it will be logged in the system log and the application name will be listed.

-
I will see if this will work when I have time. I am busy now. – George Bailey Sep 28 '11 at 18:33
This may be helpful. I figured out how to use auditpol to turn on auditing for the necessary events, but where does this go? I have not yet seen how to get to the event log except via a GUI. I will look further later, but additional info would be helpful. – George Bailey Oct 4 '11 at 17:08

As it has been pointed out by the link, a right source is auditing events of the Windows Filtering Platform. We can output needed data with the following cmd-script:

@echo off
for /f "tokens=2 delims==" %%s in ('wmic os get LocalDateTime /value') do set datetime=%%s
auditpol /set /subcategory:{0CCE9225-69AE-11D9-BED3-505054503030} /failure:enable > nul
pause
wmic ntevent where "LogFile='security' AND EventCode = 5152 AND TimeGenerated > '%datetime%'" get InsertionStrings
auditpol /set /subcategory:{0CCE9225-69AE-11D9-BED3-505054503030} /failure:disable > nul


"{0CCE9225-69AE-11D9-BED3-505054503030}" is the GUID of an event "Filtering Platform Packet Drop", 5152 is it's code. At the pause time run a program / program's action of interest and resume the script when a test finishes. Sample output:

InsertionStrings

{"504", "\device\harddiskvolume2\windows\system32\svchost.exe", "%%14592", "10.0
.0.254", "67", "255.255.255.255", "68", "17", "89509", "%%14610", "44"}
{"3348", "\device\harddiskvolume2\another\program.exe", "%%14593", "10.0.0.1", "
52006", "123.123.123.123", "80", "6", "89523", "%%14611", "48"}


With get Message /value instead of get InsertionStrings in wmic command, output is more informative but also much longer:

Message=The Windows Filtering Platform has blocked a packet.

Application Information:
Process ID:             3128
Application Name:       \device\harddiskvolume2\path\to\program.exe

Network Information:
Direction:              Outbound
Source Port:            50099
Destination Port:               80
Protocol:               6

Filter Information:
Filter Run-Time ID:     69203
Layer Name:             Connect
Layer Run-Time ID:      48


These are just excerpts from the security log, which are accessible in GUI too.

-

This vbscript will enumerate through the Windows Firewall rule settings:

'  This VBScript file includes sample code that enumerates
'  Windows Firewall rules using the Microsoft Windows Firewall APIs.

Option Explicit

Dim CurrentProfiles
Dim InterfaceArray
Dim LowerBound
Dim UpperBound
Dim iterate
Dim rule

' Profile Type
Const NET_FW_PROFILE2_DOMAIN = 1
Const NET_FW_PROFILE2_PRIVATE = 2
Const NET_FW_PROFILE2_PUBLIC = 4

' Protocol
Const NET_FW_IP_PROTOCOL_TCP = 6
Const NET_FW_IP_PROTOCOL_UDP = 17
Const NET_FW_IP_PROTOCOL_ICMPv4 = 1
Const NET_FW_IP_PROTOCOL_ICMPv6 = 58

' Direction
Const NET_FW_RULE_DIR_IN = 1
Const NET_FW_RULE_DIR_OUT = 2

' Action
Const NET_FW_ACTION_BLOCK = 0
Const NET_FW_ACTION_ALLOW = 1

' Create the FwPolicy2 object.
Dim fwPolicy2
Set fwPolicy2 = CreateObject("HNetCfg.FwPolicy2")

CurrentProfiles = fwPolicy2.CurrentProfileTypes

'// The returned 'CurrentProfiles' bitmask can have more than 1 bit set if multiple profiles
'//   are active or current at the same time

if ( CurrentProfiles AND NET_FW_PROFILE2_DOMAIN ) then
WScript.Echo("Domain Firewall Profile is active")
end if

if ( CurrentProfiles AND NET_FW_PROFILE2_PRIVATE ) then
WScript.Echo("Private Firewall Profile is active")
end if

if ( CurrentProfiles AND NET_FW_PROFILE2_PUBLIC ) then
WScript.Echo("Public Firewall Profile is active")
end if

' Get the Rules object
Dim RulesObject
Set RulesObject = fwPolicy2.Rules

' Print all the rules in currently active firewall profiles.
WScript.Echo("Rules:")

For Each rule In Rulesobject
if rule.Profiles And CurrentProfiles then
WScript.Echo("  Rule Name:          " & rule.Name)
WScript.Echo("   ----------------------------------------------")
WScript.Echo("  Description:        " & rule.Description)
WScript.Echo("  Application Name:   " & rule.ApplicationName)
WScript.Echo("  Service Name:       " & rule.ServiceName)
Select Case rule.Protocol
Case NET_FW_IP_PROTOCOL_TCP    WScript.Echo("  IP Protocol:        TCP.")
Case NET_FW_IP_PROTOCOL_UDP    WScript.Echo("  IP Protocol:        UDP.")
Case NET_FW_IP_PROTOCOL_ICMPv4 WScript.Echo("  IP Protocol:        UDP.")
Case NET_FW_IP_PROTOCOL_ICMPv6 WScript.Echo("  IP Protocol:        UDP.")
Case Else                      WScript.Echo("  IP Protocol:        " & rule.Protocol)
End Select
if rule.Protocol = NET_FW_IP_PROTOCOL_TCP or rule.Protocol = NET_FW_IP_PROTOCOL_UDP then
WScript.Echo("  Local Ports:        " & rule.LocalPorts)
WScript.Echo("  Remote Ports:       " & rule.RemotePorts)
end if
if rule.Protocol = NET_FW_IP_PROTOCOL_ICMPv4 or rule.Protocol = NET_FW_IP_PROTOCOL_ICMPv6 then
WScript.Echo("  ICMP Type and Code:    " & rule.IcmpTypesAndCodes)
end if
Select Case rule.Direction
Case NET_FW_RULE_DIR_IN  WScript.Echo("  Direction:          In")
Case NET_FW_RULE_DIR_OUT WScript.Echo("  Direction:          Out")
End Select
WScript.Echo("  Enabled:            " & rule.Enabled)
WScript.Echo("  Edge:               " & rule.EdgeTraversal)
Select Case rule.Action
Case NET_FW_ACTION_ALLOW  WScript.Echo("  Action:             Allow")
Case NET_FW_ACTION_BLOCk  WScript.Echo("  Action:             Block")
End Select
WScript.Echo("  Grouping:           " & rule.Grouping)
WScript.Echo("  Edge:               " & rule.EdgeTraversal)
WScript.Echo("  Interface Types:    " & rule.InterfaceTypes)
InterfaceArray = rule.Interfaces
if IsEmpty(InterfaceArray) then
WScript.Echo("  Interfaces:         All")
else
LowerBound = LBound(InterfaceArray)
UpperBound = UBound(InterfaceArray)
WScript.Echo("  Interfaces:     ")
for iterate = LowerBound To UpperBound
WScript.Echo("       " & InterfaceArray(iterate))
Next
end if

WScript.Echo("")
end if
Next


It came from here, which should set you on the path in the right direction.

-
I already know how to see all the rules, I need to know when an exe is blocked by a "default deny outbound rule". Then I need to know which exe is blocked. Correct me if I'm wrong, but I think this answer is not helpful for that because the script and all the links on the MSDN page seem to only talk about the rules, not adding exe to the logging. (I fixed the problem in my question, that might have been confusing) (I am not saying that what I want is possible, but I just want to know how to do it if it is possible) – George Bailey Sep 28 '11 at 16:08
I'm not sure the Windows firewall blocks anything outbound by default. – GregD Sep 28 '11 at 16:15
The default setting is to block incoming by default and allow outgoing by default. I change that using netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound. After running that, both outbound and inbound are blocked, unless one of the rules states otherwise. – George Bailey Sep 28 '11 at 18:05
Ah, it's your use of the term "default". Windows Firewall by "default" allows all outbound. You alter "default" by running your netsh command to block all inbound and all outbound, which is no longer "default"...overly pedantic I know...but it's important in some contexts..LOL – GregD Sep 28 '11 at 18:17
Yea, I know. :) – George Bailey Sep 28 '11 at 18:33