Mar 03 2021 08:29 AM
I was ran into an issue of the firewall blocking traffic but not reporting it in Microsoft Defender. When I went to turn on windows logging it was block by administrator. How to Track Firewall Activity with the Windows Firewall Log (howtogeek.com) I took a guess it was the firewall and disabled the rules. Where do I find this information when troubleshooting on the endpoint?
Mar 03 2021 08:55 AM
Mar 03 2021 08:57 AM
Mar 03 2021 09:01 AM
Mar 03 2021 09:02 AM
@Fish_Tacos When you go into the Firewall Logging section are the logs enabled and is "Log dropped packets;" configured to yes?
Mar 03 2021 09:10 AM
@Rick_Munck Shouldn't I get a pop up or alert when an application is blocked? See Screenshot.
Mar 03 2021 09:20 AM
Solution@Fish_Tacos you should but it also depends on the type of block and the app in question. You will need to look in the log I mentioned above to determine the block but by default it will not log dropped packets so you might have to step through it again to get it captured.
Mar 03 2021 09:20 AM
Solution@Fish_Tacos you should but it also depends on the type of block and the app in question. You will need to look in the log I mentioned above to determine the block but by default it will not log dropped packets so you might have to step through it again to get it captured.