firewall rule time

[vinifera]

is there a way to see when (date) was certain rule (app blocked or allowed) ?

I don't see in fw settings anything that shows it

[GrofLuigi]

In the registry it is the key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

You can export that key to .txt format with regedit to see the last write time (for the entire key). If you export it to .reg format, on the bottom will be the last created values (but it's not guaranteed).

There are other registry tools that can read and display last write time of keys. I don't know if any of them can do the same for values (but I haven't looked hard). It might be impossible.

RegScanner from Nirsoft can search registry (keys only?) by date.

GL

Edited November 6, 2012 by GrofLuigi

[vinifera]

I meant more like

for each rule

as in when was each rule made

[GrofLuigi]

I meant more like

for each rule

as in when was each rule made

Yes, I know, but I'm not sure it's possible.

GL

[vinifera]

seems it isn't

as firewall doesn't record jack s***

such disapointment...

[GrofLuigi]

Now that you mentioned it, there might be something in the firewall log (if you enable it first), but I'm almost sure there will be something in the event log (if you manage to find the event ).

GL

[vinifera]

well event viewer shows nothing (probably coz it was flushed at some time)

and firewall log doesn't even exist on my PC

[GrofLuigi]

Well, you need to turn it on http://technet.microsoft.com/en-us/library/cc742433.aspx

But I think it logs only dropped/passed packets, not creation of rules.

GL