Hello, please tell me, whether events are created, while firewall modifications? I want to see, which modifications are done by a new installed program. Thank you Erhy

Hi, This can be done by enabling security logging using the steps outlined below. 1.Click Start, All Programs, and Administrative Tools. 2.Select Windows Firewall with Advanced Security. 3.Click Windows Firewall Properties. 4.Click one of the profile tabs, such as Public Profile. 5.Click the Customize button within the Logging area. 6.Enable firewall logging from the dialog box that appears. 7.Click OK. Once you enable security logging, information is written to a log file that is stored in the Windows directory. Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

For me it looks, that if I enable the logging, log entries are made belonging the network connection, but not on modifications of the rules. I'm right? Erhy

Hi Erhy, If that modifications of the rules is what you want, there seems no direct way of such records of changes. One method is to monitor registry using one feature of Process Explorer. Regards, Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Erhy, If that modifications of the rules is what you want, there seems no direct way of such records of changes. One method is to monitor registry using one feature of Process Explorer. Regards, Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I hoped that might be possible with well configured audit. I found a list of possible messages, where some items are for logging modifications of the firewall: Security audit events for Microsoft Windows Server 2008 and Microsoft Windows Vista Please tell me, how turn on the options to have such logs. Erhy

Hi, The Excel shows Event ID which can be viewed via Event Viewer. Please click Start, type Event viewer and click. Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Of course, events and audits are able to visit with the Event viewer; though certain event groups have to be enabled for logging. I installed new software whereby a firewall rule was added, but I could not find a corresponding event. Erhy