I'm trying to find out which process or user changed the firewall from Off to On.
So I've issued a query to LogParser:
SELECT
timegenerated,
EXTRACT_TOKEN(Strings,1,'|') AS Domain,
EXTRACT_TOKEN(Strings,0,'|') AS User,
EXTRACT_TOKEN(Strings,3,'|') AS SessionName,
EXTRACT_TOKEN(Strings,4,'|') AS ClientName,
EXTRACT_TOKEN(Strings,5,'|') AS ClientAddress,
EventID
FROM Security
WHERE timegenerated > '2014-02-18 18:30:00' AND timegenerated < '2014-02-18 18:32:50'
ORDER BY timegenerated DESC
And I could see the following row (among many others):
timegenerated Domain User SessionName ClientName ClientAddress EventID
2014-02-18 18:30:07 Enable Windows Firewall Domain NULL NULL NULL 4950
It doesn't says much. What should I perform in order to find out the user or process that enabled the firewall? This user might be connecting remotely or he might be local.
BTW. This info from logparser is now gone... I should've save it.
Edit #1, 19-02-2014 07:20 UTC:
I went to the event viewer.
From there, on the left menu/tree, I clicked on: Applications and Services Logs
-> Microsoft
-> Windows
-> Windows Firewall With Advanced Security
-> Firewall
.
And then I could see that a user (here, referred as UserNameFooBar
) has enabled the firewall:
A Windows Firewall setting in the Domain profile has changed.
New Setting:
Type: Enable Windows Firewall
Value: No
Modifying User: DomainName\UserNameFooBar
Modifying Application: C:\Windows\explorer.exe
It was logged at 2/18/2014 6:30:07 PM.
But how can I tell whether:
- This user is a system user (means that Windows used this user to perform the action)?
- This user connected locally or remote?