Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Photo

firewall rule time


  • Please log in to reply
7 replies to this topic

#1
vinifera

vinifera

    <°)))><

  • Member
  • PipPipPipPipPip
  • 947 posts
  • OS:Windows 7 x86
  • Country: Country Flag
is there a way to see when (date) was certain rule (app blocked or allowed) ?
I don't see in fw settings anything that shows it
If you want true Windows user experience
try Longhorn builds: 3718, 4029, 4066


How to remove advertisement from MSFN

#2
GrofLuigi

GrofLuigi

    GroupPolicy Tattoo Artist

  • Member
  • PipPipPipPipPipPip
  • 1,349 posts
  • OS:none specified
  • Country: Country Flag
In the registry it is the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

You can export that key to .txt format with regedit to see the last write time (for the entire key). If you export it to .reg format, on the bottom will be the last created values (but it's not guaranteed).

There are other registry tools that can read and display last write time of keys. I don't know if any of them can do the same for values (but I haven't looked hard). It might be impossible.

RegScanner from Nirsoft can search registry (keys only?) by date.

GL

Edited by GrofLuigi, 06 November 2012 - 04:04 PM.


#3
vinifera

vinifera

    <°)))><

  • Member
  • PipPipPipPipPip
  • 947 posts
  • OS:Windows 7 x86
  • Country: Country Flag
I meant more like
for each rule

as in when was each rule made :P
If you want true Windows user experience
try Longhorn builds: 3718, 4029, 4066

#4
GrofLuigi

GrofLuigi

    GroupPolicy Tattoo Artist

  • Member
  • PipPipPipPipPipPip
  • 1,349 posts
  • OS:none specified
  • Country: Country Flag

I meant more like
for each rule

as in when was each rule made :P


Yes, I know, but I'm not sure it's possible.

GL

#5
vinifera

vinifera

    <°)))><

  • Member
  • PipPipPipPipPip
  • 947 posts
  • OS:Windows 7 x86
  • Country: Country Flag
seems it isn't
as firewall doesn't record jack s***

such disapointment...
If you want true Windows user experience
try Longhorn builds: 3718, 4029, 4066

#6
GrofLuigi

GrofLuigi

    GroupPolicy Tattoo Artist

  • Member
  • PipPipPipPipPipPip
  • 1,349 posts
  • OS:none specified
  • Country: Country Flag
Now that you mentioned it, there might be something in the firewall log (if you enable it first), but I'm almost sure there will be something in the event log (if you manage to find the event :) ).

GL

#7
vinifera

vinifera

    <°)))><

  • Member
  • PipPipPipPipPip
  • 947 posts
  • OS:Windows 7 x86
  • Country: Country Flag
well event viewer shows nothing (probably coz it was flushed at some time)
and firewall log doesn't even exist on my PC :(
If you want true Windows user experience
try Longhorn builds: 3718, 4029, 4066

#8
GrofLuigi

GrofLuigi

    GroupPolicy Tattoo Artist

  • Member
  • PipPipPipPipPipPip
  • 1,349 posts
  • OS:none specified
  • Country: Country Flag
Well, you need to turn it on http://technet.micro...y/cc742433.aspx

But I think it logs only dropped/passed packets, not creation of rules.

GL




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users



How to remove advertisement from MSFN