Windows firewall logs on the endpoint.

[Fish_Tacos]

I was ran into an issue of the firewall blocking traffic but not reporting it in Microsoft Defender. When I went to turn on windows logging it was block by administrator. How to Track Firewall Activity with the Windows Firewall Log (howtogeek.com) I took a guess it was the firewall and disabled the rules. Where do I find this information when troubleshooting on the endpoint? 

[#2]

Firewall events should be in the security event log if it has been turned on

[#3]

Try this: https://docs.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging

[#4]

Local users don't have rights to view the security log.

[#5]

@Fish_Tacos When you go into the Firewall Logging section are the logs enabled and is "Log dropped packets;" configured to yes?

[#6]

@Rick_Munck Shouldn't I get a pop up or alert when an application is blocked? See Screenshot. 

[#7 · Accepted solution]

@Fish_Tacos you should but it also depends on the type of block and the app in question.  You will need to look in the log I mentioned above to determine the block but by default it will not log dropped packets so you might have to step through it again to get it captured.