vinifera Posted November 6, 2012 Share Posted November 6, 2012 is there a way to see when (date) was certain rule (app blocked or allowed) ?I don't see in fw settings anything that shows it Link to comment Share on other sites More sharing options...
GrofLuigi Posted November 6, 2012 Share Posted November 6, 2012 (edited) In the registry it is the key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRulesYou can export that key to .txt format with regedit to see the last write time (for the entire key). If you export it to .reg format, on the bottom will be the last created values (but it's not guaranteed).There are other registry tools that can read and display last write time of keys. I don't know if any of them can do the same for values (but I haven't looked hard). It might be impossible.RegScanner from Nirsoft can search registry (keys only?) by date.GL Edited November 6, 2012 by GrofLuigi Link to comment Share on other sites More sharing options...
vinifera Posted November 7, 2012 Author Share Posted November 7, 2012 I meant more likefor each ruleas in when was each rule made Link to comment Share on other sites More sharing options...
GrofLuigi Posted November 7, 2012 Share Posted November 7, 2012 I meant more likefor each ruleas in when was each rule made Yes, I know, but I'm not sure it's possible.GL Link to comment Share on other sites More sharing options...
vinifera Posted November 9, 2012 Author Share Posted November 9, 2012 seems it isn'tas firewall doesn't record jack s***such disapointment... Link to comment Share on other sites More sharing options...
GrofLuigi Posted November 9, 2012 Share Posted November 9, 2012 Now that you mentioned it, there might be something in the firewall log (if you enable it first), but I'm almost sure there will be something in the event log (if you manage to find the event ).GL Link to comment Share on other sites More sharing options...
vinifera Posted November 9, 2012 Author Share Posted November 9, 2012 well event viewer shows nothing (probably coz it was flushed at some time)and firewall log doesn't even exist on my PC Link to comment Share on other sites More sharing options...
GrofLuigi Posted November 9, 2012 Share Posted November 9, 2012 Well, you need to turn it on http://technet.microsoft.com/en-us/library/cc742433.aspxBut I think it logs only dropped/passed packets, not creation of rules.GL Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now