Have you ever been in this situation, where an app on your computer is having
connection issues and you can't figure out why? And you think,
"Well maybe I want to figure out if it's the Windows Firewall blocking it,
or at least eliminate it as a possibility while troubleshooting." Well surprisingly, by default
the Windows Firewall does not have any kind of logging enabled for blocked connections, but in
this video I'll show you how to enable that hidden logging feature, and it's actually pretty quick.
And further I'll also show you how to set up a custom filter in Event Viewer to get all the log
info in a format that's actually readable, instead of the usual text file log, which is not. And this
whole thing will just take a couple of minutes, it's really easy to follow. One important thing
to note is if you have an antivirus that uses its own firewall and disables the Windows Firewall,
none of this will really apply, but I still think it's good to know about for the future.
So first off, here's how to enable the logging feature in the Windows Firewall
in the first place. First we just need to get to the firewall settings,
so in the start menu search for Firewall, and then click where it says, "Windows Defender
Firewall with Advanced Security." On the left hand side, right click the thing at
the top that says "Windows Defender Firewall" blah blah blah, and then click Properties.
Notice the three tabs at the top that say Domain Profile, Private Profile, and Public Profile. We
will need to do the same thing for all three. Under Logging, click Customize,
and then change the option for "Logged Dropped Packets" to Yes. I would also change the log size
limit to its maximum of 32 megabytes, it's not that much space so I don't see a reason why not.
Then you click OK to apply it, and you do the same steps for private profile and public profile.
You change Log Drop Packets to yes, and if you want, change the log size limit. The log file
it creates will appear in this directory, but we're not done yet because notice how
it will list the block connections, but not in a very readable or easy to understand format.
It'll tell you stuff like whether it was an outgoing or incoming connection
as either send or receive, and it says the originating IP and destination IP,
the type of packet, the ports, stuff like that. But it doesn't even say the name of
the process while making the connection, and while it does say the process ID,
if you're looking at that at a later time when that might have changed, that could be an issue.
But there is a way to make all of this way easier to interpret. So next in this part I'm
going to show you how to make an Event Viewer custom filter to easily see all the same info,
but nicely organized and labeled, and it even says the path and the name of
the program making the connection. This time search the start menu for Event Viewer and
open that up, and then on the left look for "Windows Logs" and then "Security".
However this filter view won't actually show blocked connections by default,
so you just have to enable that with the following command. So open the command
prompt as admin and copy and paste it, I'll put it in the description,
and run that command and it should now show blocked connections in this event viewer view.
However we're still not done because here all those blocked connection logs will be
kind of mixed in with other security logs. So what we can do is create a custom filter that
only shows the blocked connections. And this is really easy, just right click on "Security",
and then click "Create Custom View." In the box that says "All Event IDs",
change that to be 5157, which is the event ID for a blocked connection.
Then at the top, this is optional, but you may choose to change it from "Any
Time" to maybe just the last 24 hours, in case you only care about the recent ones,
but that's up to you. Next it'll let you change the name, so you can put whatever you want, like
blocked firewall connections, or maybe recently blocked firewall connections if you set a time.
And by default it will go into the custom views folder, but of course you can create
more and arrange it however you want. But when you have it set how you want,
just click ok. And now you have your very own log that is easily accessible when you
open up the event viewer, you can click right on it and see blocked connections.
Finally a couple things to note. You may choose to not even have the logging on all the time,
and only turn it on if you're having a problem,
and then you can use the logging in that case. Also I seem to remember in the past,
the logging may have turned itself off, though I might have changed a setting or something.
So if you notice that the firewall is not logging anything, I would just go and double
check that the logging is still turned on. So pretty straightforward if you ask me,
and hopefully this will come in handy the next time you do some
network troubleshooting perhaps. Let me know down in the comments though,
if there's maybe an additional tip that might make things even better that I missed or something.
And also be sure to check down there in case someone did leave a good comment.
If you enjoyed this video, definitely for this one, be sure to lightly tap the like
button for my YouTube algorithm overlords. This is probably going to be a shorter video than usual,
so we got to bump up that algorithm. If you enjoyed this video, the next video you might
find interesting is where I was talking about those different HKEY Registry keys.
You might've wondered what each one is actually for. So I explain that,
and it's pretty interesting. You can just click on that right there.
So thanks so much for watching, and I'll see you in the next one.