up vote 1 down vote favorite
share [g+] share [fb]

I'm trying to configure Windows Firewall with Advanced Security to log and tell me when programs are trying to make outbound requests. I previously tried installing ZoneAlarm, which worked wonders for me with this in XP, but now, I'm unable to install ZA on Win7. My question is, is it possible to somehow monitor a log or get notifications when a program tries to do that if I set all outbound connections to auto-block, so that I can then create a specific rule for the program and block it.?

Thanks!

UPDATE: I've enabled all the logging options available through the Properties windows of the Windows Firewall with Advanced Security Console, but I am only seeing logs in the %systemroot%\system32\LogFiles\Firewall\pfirewall.log file, not in the Event Viewer, as the first answer suggested. However, the logs that I can see only tell me the request's or response's destination IP and whether the connection was allowed or blocked, but it doesn't tell me what executable it comes from. I want to find out the file path of the executable that each blocked request comes from. So far, I haven't been able to.

link|improve this question
74% accept rate
feedback

1 Answer

up vote 0 down vote accepted

You should be able to see this in Event Viewer. First you'll need to tweak the logging options in the Advanced Settings Console:

alt text

In the Event Viewer's left pane, expand to Applications and Services Log -> Microsoft -> Windows -> Windows Firewall with Advanced Security:

alt text

There, you can create a custom view and filter the log to only outbound connection attempts.

link|improve this answer
Thanks! What do I need to tweak in particular in the Advanced Settings console? Are you referring to the logging options under Properties? If so, what do I need to change? – Maxim Zaslavsky Jan 19 '10 at 6:07
You can tweak the logging options depending on your liking, but you'll have to first set rules for outbound connections or else there is nothing seen as abnormal and nothing will be logged. – John T Jan 19 '10 at 13:20
How do I filter the log? I blocked all outbound connections but nothing is appearing in any of the logs there except for changes to the firewall settings. What should I do? – Maxim Zaslavsky Jan 21 '10 at 2:40
Nothing in %windir%\system32\logfiles\firewall\firewall.log ? – John T Jan 21 '10 at 4:29
I mentioned in my update of the original question that only destination IPs are listed. I'm looking for the file path of the executable that made the request. – Maxim Zaslavsky Jan 21 '10 at 4:59
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.