There is an event telling me that it could not show me an event.Technet has a workaround but is does not work - I get a message about not having sufficient access Log Name: SecuritySource: Microsoft-Windows-Security-AuditingDate: 8/02/2009 3:37:51 AMEvent ID: 5032Task Category: Other System EventsLevel: InformationKeywords: Audit FailureUser: N/AComputer: ZZZZZDescription:Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network. Error Code:2Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>5032</EventID> <Version>0</Version> <Level>0</Level> <Task>12292</Task> <Opcode>0</Opcode> <Keywords>0x8010000000000000</Keywords> <TimeCreated SystemTime="2009-02-07T17:37:51.151703100Z" /> <EventRecordID>976</EventRecordID> <Correlation /> <Execution ProcessID="524" ThreadID="624" /> <Channel>Security</Channel> <Computer>ZZZZZ</Computer> <Security /> </System> <EventData> <Data Name="ErrorCode">2</Data> </EventData></Event>

HiYou must use administrative account and UAC must be enabled if you do not want problems.If solution require using of command prompt then run command prompt from start menu as administrator(right click->run as administrator)If you use some other tool, make sure you have ran it as administrator too

This event is written because the FW blocked an incoming connection request for a service. However, the service user could not benotified as it runs in session 0 on Vista and higher. Services on Vista and higher, do run in session 0, and this session is not attached to a visible desktop by default. That's why the message get's logged in the eventlog.In short you have a service running that apparently tries to accept connection from the outside world. It's up to you to find out what service is trying to accept in-bound connections.

Thanks, but I tried that one. I ran cmd as administrator. Just for a laugh, a built a separate admin account and tried using runas but had the same failure

Thanks. That looks like a great description of the bug. Now, how do we log a bug so theMS developers can fix it?

What is fix you cannot execute because you get access denied error?

watsbe, it's not a bug, it's "by design". The FW process cannot notify non-interactive users, please read thishttp://technet.microsoft.com/en-us/library/cc733407.aspxcarefully.

If so, I have to wonder about the design. Surely there is some way that the firewall can record the actions it has taken. A log file? Carrier pigeon?

watsbe said: If so, I have to wonder about the design. Surely there is some way that the firewall can record the actions it has taken. A log file? Carrier pigeon?As Willy said, it logs the event in the event log. That is how it records the action it has taken.

It didn't log the event in the event log. It logged the fact that it didn't log an event in the event log.Doesn't matter. Looks like this whole thing is a marketing joke.

For me the same, this shity firewall for no reason blocked the connection with my windows mobile device. PDA and computer used to synchronize without a problem but now sync is blocked. Firewall log file is empty. The only work around for me is switching off windows firewall. Unfortunately I can't create working rules allowing this traffic.