1

i enabled my windows 7 firewall to by default block all outbound connections by default. i configure each and every program that needs network access in the 'Windows Firewall with Advanced Security' mmc. problem is sometimes i cant find the program that needs network access. i enabled firewall logging but that log file does not contain the PID of the process that was blocked.

2010-08-26 17:57:33 DROP TCP 192.168.1.200 24.143.204.147 64883 80 0 - 0 0 0 - - - SEND
2010-08-26 17:57:33 DROP TCP 192.168.1.200 24.143.204.129 64884 80 0 - 0 0 0 - - - SEND
2010-08-26 17:58:10 DROP TCP 192.168.1.200 24.143.204.147 64885 80 0 - 0 0 0 - - - SEND

i know that this connection is triggered by the Games for Windows Live process, but allowing that specific executeable to go through the firewall does not prevent these connections from being dropped. how do i find out what actual program (or service) is trying to open up these connections, so i can make a firewall rule to allow it?

Improve this question

1 Answer 1

Reset to default
1

Three years late, but still, if anyone needs to know, my solution would be one of the following:

  1. program that installs its own firewall driver with notification functionality (NetLimiter, Comodo Firewall)
  2. program that enables audit logging of blocked connections into security log (WFNotifier, WFControl)
  3. auditpol /set /subcategory:{0CCE9226-69AE-11D9-BED3-505054503030} /failure:enable
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .