2

I'm trying to find out which process or user changed the firewall from Off to On.

So I've issued a query to LogParser:

SELECT 
      timegenerated, 
      EXTRACT_TOKEN(Strings,1,'|') AS Domain, 
      EXTRACT_TOKEN(Strings,0,'|') AS User, 
      EXTRACT_TOKEN(Strings,3,'|') AS SessionName,
      EXTRACT_TOKEN(Strings,4,'|') AS ClientName,
      EXTRACT_TOKEN(Strings,5,'|') AS ClientAddress,
      EventID
FROM Security 
WHERE timegenerated > '2014-02-18 18:30:00' AND timegenerated < '2014-02-18 18:32:50'
ORDER BY timegenerated DESC

And I could see the following row (among many others):

timegenerated   Domain  User    SessionName ClientName  ClientAddress EventID
2014-02-18 18:30:07 Enable Windows Firewall Domain  NULL    NULL    NULL    4950

It doesn't says much. What should I perform in order to find out the user or process that enabled the firewall? This user might be connecting remotely or he might be local.

BTW. This info from logparser is now gone... I should've save it.


Edit #1, 19-02-2014 07:20 UTC:

I went to the event viewer. From there, on the left menu/tree, I clicked on: Applications and Services Logs -> Microsoft -> Windows -> Windows Firewall With Advanced Security -> Firewall.

And then I could see that a user (here, referred as UserNameFooBar) has enabled the firewall:

A Windows Firewall setting in the Domain profile has changed.
New Setting:
    Type:   Enable Windows Firewall
    Value:  No
    Modifying User: DomainName\UserNameFooBar
    Modifying Application:  C:\Windows\explorer.exe

It was logged at 2/18/2014 6:30:07 PM.

But how can I tell whether:

  1. This user is a system user (means that Windows used this user to perform the action)?
  2. This user connected locally or remote?
3
  • Is this computer on a domain? If so, are there any group policies set to enable the firewall (like say, if the system leaves the domain)? If you dig back through the Event logs, who logged in last before that happened? Feb 18, 2014 at 18:47
  • @techie007: Yes it's on a domain. Plz see my 1st edit, I've added data from event viewer..
    – Dor
    Feb 19, 2014 at 7:23
  • unfortunately that's not the event log data I suggested you provide. :) Two questions (again): Are there any group policies set to configure the firewall? If you dig back through the Event logs, who logged in last before that happened? <-- you're looking for logon events, not service change events, as the logon events will tell you how they logged on as well (usually). Check this out for more info and the event ID's you want to look for: blogs.msdn.com/b/ericfitz/archive/2008/08/20/… Feb 19, 2014 at 15:55

0

You must log in to answer this question.

Browse other questions tagged .