SMB Firewall rule enabled after reboot for public network profile
Hallo,
Due to some reason after every reboot file and printer sharing is turned on after reboot. It was disabled before the reboot, but after the reboot is is enabled (in public network profile) AND the firewall rule has been turned on (maybe it is one step, I
don't know).
Log Name: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
Source: Microsoft-Windows-Windows Firewall With Advanced Security
Date: 16.12.2010 15:56:29
Event ID: 2005
Task Category: None
Level: Information
Keywords: (2199023255552)
User: LOCAL SERVICE
Computer: mobilegraf
Description:
A rule has been modified in the Windows Firewall exception list.
Modified Rule:
Rule ID: FPS-SMB-In-TCP
Rule Name: File and Printer Sharing (SMB-In)
Origin: Local
Active: Yes
Direction: Inbound
Profiles: Public
Action: Allow
Application Path: System
Service Name:
Protocol: TCP
Security Options: None
Edge Traversal: None
Modifying User: SYSTEM
Modifying Application: C:\Windows\System32\svchost.exe
Do I have any chance to figure out, what is going wrong?
Thanks!
Franz
December 16th, 2010 3:14pm
No idea? I have already logged the boot sequence with procmon, but I didn't find out the reason... maybe you have some hint what I could look for?
Free Windows Admin Tool Kit Click here and download it now
December 18th, 2010 3:25pm
Hi,
Are you in a domain environment? And are there any related policies configured?
Currently, please try to set the Windows Firewall Service to Automatic, and then start the service to check what the result is.
If the issue persists, please try to perform
Clean Boot to check the result.
Hope it helps.
Alex Zhao
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
December 20th, 2010 5:59am