Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We would like to distribute a firewall program with our product.

I can configure the Windows Firewall to block outgoing connections (which it does not by default)

netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound

But then I need to know when one is blocked so it can ask if it should be unblocked.

I tried turning on logging, but it does not log the path to the exe. Is there a way to get that logged?

I posted a question on StackOverflow to try an event detection method, but if there was a way to turn on logging of the path to the exe, I wanted to know about it. I hope to stay with Java which is limited in event detection.

I don't mind calling any command-line programs, also don't mind using vbscripts. But what I need is to know as soon as an outgoing connection from an exe is blocked and which exe.

share|improve this question
Is this a one-time thing for something you're testing, or something you need to know as a function of your program? I don't think the ability is built in to Windows firewall but there were third-party applications that did. – Bart Silverstrim Sep 28 '11 at 16:16
Whatever solution needs to be distributed with my program. It is not a one time thing. If there was a third-party program that I could control through the command-line it might be acceptable, but it is probably going to be necessary for us to control all the GUIs, and we do not want to have to pay for it. – George Bailey Sep 28 '11 at 18:07

I believe this is what you are looking for: application logging

Once this is configured it will be logged in the system log and the application name will be listed.

share|improve this answer
I will see if this will work when I have time. I am busy now. – George Bailey Sep 28 '11 at 18:33
This may be helpful. I figured out how to use auditpol to turn on auditing for the necessary events, but where does this go? I have not yet seen how to get to the event log except via a GUI. I will look further later, but additional info would be helpful. – George Bailey Oct 4 '11 at 17:08

As it has been pointed out by the link, a right source is auditing events of the Windows Filtering Platform. We can output needed data with the following cmd-script:

@echo off
for /f "tokens=2 delims==" %%s in ('wmic os get LocalDateTime /value') do set datetime=%%s
auditpol /set /subcategory:{0CCE9225-69AE-11D9-BED3-505054503030} /failure:enable > nul
wmic ntevent where "LogFile='security' AND EventCode = 5152 AND TimeGenerated > '%datetime%'" get InsertionStrings
auditpol /set /subcategory:{0CCE9225-69AE-11D9-BED3-505054503030} /failure:disable > nul

"{0CCE9225-69AE-11D9-BED3-505054503030}" is the GUID of an event "Filtering Platform Packet Drop", 5152 is it's code. At the pause time run a program / program's action of interest and resume the script when a test finishes. Sample output:


{"504", "\device\harddiskvolume2\windows\system32\svchost.exe", "%%14592", "10.0
.0.254", "67", "", "68", "17", "89509", "%%14610", "44"}
{"3348", "\device\harddiskvolume2\another\program.exe", "%%14593", "", "
52006", "", "80", "6", "89523", "%%14611", "48"}

With get Message /value instead of get InsertionStrings in wmic command, output is more informative but also much longer:

Message=The Windows Filtering Platform has blocked a packet.

Application Information:
        Process ID:             3128
        Application Name:       \device\harddiskvolume2\path\to\program.exe

Network Information:
        Direction:              Outbound
        Source Address:
        Source Port:            50099
        Destination Address:
        Destination Port:               80
        Protocol:               6

Filter Information:
        Filter Run-Time ID:     69203
        Layer Name:             Connect
        Layer Run-Time ID:      48

These are just excerpts from the security log, which are accessible in GUI too.

share|improve this answer

This vbscript will enumerate through the Windows Firewall rule settings:

'  This VBScript file includes sample code that enumerates
'  Windows Firewall rules using the Microsoft Windows Firewall APIs.

Option Explicit

Dim CurrentProfiles
Dim InterfaceArray
Dim LowerBound
Dim UpperBound
Dim iterate
Dim rule

' Profile Type

' Protocol

' Direction

' Action

' Create the FwPolicy2 object.
Dim fwPolicy2
Set fwPolicy2 = CreateObject("HNetCfg.FwPolicy2")

CurrentProfiles = fwPolicy2.CurrentProfileTypes

'// The returned 'CurrentProfiles' bitmask can have more than 1 bit set if multiple profiles 
'//   are active or current at the same time

if ( CurrentProfiles AND NET_FW_PROFILE2_DOMAIN ) then
   WScript.Echo("Domain Firewall Profile is active")
end if

if ( CurrentProfiles AND NET_FW_PROFILE2_PRIVATE ) then
   WScript.Echo("Private Firewall Profile is active")
end if

if ( CurrentProfiles AND NET_FW_PROFILE2_PUBLIC ) then
   WScript.Echo("Public Firewall Profile is active")
end if

' Get the Rules object
Dim RulesObject
Set RulesObject = fwPolicy2.Rules

' Print all the rules in currently active firewall profiles.

For Each rule In Rulesobject
    if rule.Profiles And CurrentProfiles then
        WScript.Echo("  Rule Name:          " & rule.Name)
        WScript.Echo("   ----------------------------------------------")
        WScript.Echo("  Description:        " & rule.Description)
        WScript.Echo("  Application Name:   " & rule.ApplicationName)
        WScript.Echo("  Service Name:       " & rule.ServiceName)
        Select Case rule.Protocol
            Case NET_FW_IP_PROTOCOL_TCP    WScript.Echo("  IP Protocol:        TCP.")
            Case NET_FW_IP_PROTOCOL_UDP    WScript.Echo("  IP Protocol:        UDP.")
            Case NET_FW_IP_PROTOCOL_ICMPv4 WScript.Echo("  IP Protocol:        UDP.")
            Case NET_FW_IP_PROTOCOL_ICMPv6 WScript.Echo("  IP Protocol:        UDP.")
            Case Else                      WScript.Echo("  IP Protocol:        " & rule.Protocol)
        End Select
        if rule.Protocol = NET_FW_IP_PROTOCOL_TCP or rule.Protocol = NET_FW_IP_PROTOCOL_UDP then
            WScript.Echo("  Local Ports:        " & rule.LocalPorts)
            WScript.Echo("  Remote Ports:       " & rule.RemotePorts)
            WScript.Echo("  LocalAddresses:     " & rule.LocalAddresses)
            WScript.Echo("  RemoteAddresses:    " & rule.RemoteAddresses)
        end if
        if rule.Protocol = NET_FW_IP_PROTOCOL_ICMPv4 or rule.Protocol = NET_FW_IP_PROTOCOL_ICMPv6 then
            WScript.Echo("  ICMP Type and Code:    " & rule.IcmpTypesAndCodes)
        end if
        Select Case rule.Direction
            Case NET_FW_RULE_DIR_IN  WScript.Echo("  Direction:          In")
            Case NET_FW_RULE_DIR_OUT WScript.Echo("  Direction:          Out")
        End Select
        WScript.Echo("  Enabled:            " & rule.Enabled)
        WScript.Echo("  Edge:               " & rule.EdgeTraversal)
        Select Case rule.Action
            Case NET_FW_ACTION_ALLOW  WScript.Echo("  Action:             Allow")
            Case NET_FW_ACTION_BLOCk  WScript.Echo("  Action:             Block")
        End Select
        WScript.Echo("  Grouping:           " & rule.Grouping)
        WScript.Echo("  Edge:               " & rule.EdgeTraversal)
        WScript.Echo("  Interface Types:    " & rule.InterfaceTypes)
        InterfaceArray = rule.Interfaces
        if IsEmpty(InterfaceArray) then
            WScript.Echo("  Interfaces:         All")
            LowerBound = LBound(InterfaceArray)
            UpperBound = UBound(InterfaceArray)
            WScript.Echo("  Interfaces:     ")
            for iterate = LowerBound To UpperBound
                WScript.Echo("       " & InterfaceArray(iterate))
        end if

    end if

It came from here, which should set you on the path in the right direction.

share|improve this answer
I already know how to see all the rules, I need to know when an exe is blocked by a "default deny outbound rule". Then I need to know which exe is blocked. Correct me if I'm wrong, but I think this answer is not helpful for that because the script and all the links on the MSDN page seem to only talk about the rules, not adding exe to the logging. (I fixed the problem in my question, that might have been confusing) (I am not saying that what I want is possible, but I just want to know how to do it if it is possible) – George Bailey Sep 28 '11 at 16:08
I'm not sure the Windows firewall blocks anything outbound by default. – GregD Sep 28 '11 at 16:15
The default setting is to block incoming by default and allow outgoing by default. I change that using netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound. After running that, both outbound and inbound are blocked, unless one of the rules states otherwise. – George Bailey Sep 28 '11 at 18:05
Ah, it's your use of the term "default". Windows Firewall by "default" allows all outbound. You alter "default" by running your netsh command to block all inbound and all outbound, which is no longer "default"...overly pedantic I know...but it's important in some contexts..LOL – GregD Sep 28 '11 at 18:17
Yea, I know. :) – George Bailey Sep 28 '11 at 18:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.