How to disable 'hidden' Windows Firewall Filter?

Question

I have used the command "netsh WFP Show State" to dump to disk (wfpstate.xml) a list of all active windows filters, and found a filter called "Port Scanning Prevention Filter". For diagnostic purposes, I need to test disabling this particular filter, but I cannot find this within the UI for Windows Firewall (Windows 7 Ultimate x64 Sp1). Below is the full XML representation of the filter in question.

How do I disable this specific filter? How would I re-enable this filter?

<item>
    <filterKey>{c06945c4-54f1-4b79-9523-71ad3ba2e3be}</filterKey>
    <displayData>
        <name>Port Scanning Prevention Filter</name>
        <description>This filter prevents port scanning.</description>
    </displayData>
    <flags/>
    <providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
    <providerData>
        <data>ffffffffffffffff</data>
        <asString>........</asString>
    </providerData>
    <layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
    <subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
    <weight>
        <type>FWP_UINT8</type>
        <uint8>12</uint8>
    </weight>
    <filterCondition numItems="1">
        <item>
            <fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
            <matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
            <conditionValue>
                <type>FWP_UINT32</type>
                <uint32>1</uint32>
            </conditionValue>
        </item>
    </filterCondition>
    <action>
        <type>FWP_ACTION_CALLOUT_TERMINATING</type>
        <calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP</calloutKey>
    </action>
    <rawContext>0</rawContext>
    <reserved/>
    <filterId>230591</filterId>
    <effectiveWeight>
        <type>FWP_UINT64</type>
        <uint64>13835058055315718144</uint64>
    </effectiveWeight>
</item>

Answer 1

got exactly the same issue on Windows Server 2008 R2 Web, fresh install. Although the port 80 is all-open in Firewall, I get dozens of Audit events in Security log.

From the WFP trace I have:

<item>
    <header>
        <timeStamp>2011-12-29T20:31:22.695Z</timeStamp>
        <flags numItems="6">
            <item>FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET</item>
            <item>FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET</item>
            <item>FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET</item>
            <item>FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET</item>
            <item>FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET</item>
            <item>FWPM_NET_EVENT_FLAG_IP_VERSION_SET</item>
        </flags>
        <ipVersion>FWP_IP_VERSION_V4</ipVersion>
        <ipProtocol>6</ipProtocol>
        <localAddrV4>87.98.235.xxx</localAddrV4>
        <remoteAddrV4>83.243.104.xxx</remoteAddrV4>
        <localPort>80</localPort>
        <remotePort>58309</remotePort>
        <scopeId>0</scopeId>
        <appId/>
        <userId/>
    </header>
    <type>FWPM_NET_EVENT_TYPE_CLASSIFY_DROP</type>
    <classifyDrop>
        <filterId>74913</filterId>
        <layerId>13</layerId>
        <reauthReason>0</reauthReason>
        <originalProfile>0</originalProfile>
        <currentProfile>0</currentProfile>
    </classifyDrop>
</item>

and the matching filter is:

                <item>
                    <filterKey>{e7b69f19-9168-4b39-9705-99cb4f16a219}</filterKey>
                    <displayData>
                        <name>Port Scanning Prevention Filter</name>
                        <description>This filter prevents port scanning.</description>
                    </displayData>
                    <flags/>
                    <providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
                    <providerData>
                        <data>ffffffffffffffff</data>
                        <asString>........</asString>
                    </providerData>
                    <layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
                    <subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
                    <weight>
                        <type>FWP_UINT8</type>
                        <uint8>12</uint8>
                    </weight>
                    <filterCondition numItems="1">
                        <item>
                            <fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
                            <matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
                            <conditionValue>
                                <type>FWP_UINT32</type>
                                <uint32>1</uint32>
                            </conditionValue>
                        </item>
                    </filterCondition>
                    <action>
                        <type>FWP_ACTION_CALLOUT_TERMINATING</type>
                        <calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP</calloutKey>
                    </action>
                    <rawContext>0</rawContext>
                    <reserved/>
                    <filterId>74913</filterId>
                    <effectiveWeight>
                        <type>FWP_UINT64</type>
                        <uint64>13835058055315718144</uint64>
                    </effectiveWeight>
                </item>

Yet everything seems to work fine, service is accessible so I just disabled the audit events with auditpol util for the time being. Strange enough it only happens on one of the 3 IP addresses I use. And only on port 80 of several I have binded. I got the clue from here: http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5441

Not sure what to do with this, it's good the scanning is being blocked, but how can I be sure it doesn't block normal traffic?