Windows 10: Windows 10 - Windows-Security-Auditing-Windows Firewall did not apply the following rule-...

Can anyone help me with this error/event. I browsed internet and didn't find any forum that could help me understand how to fix this. I am getting this error again and again.




2019 Sep 20 15:03:47 WinEvtLog: Security: AUDIT_FAILURE(4957): Microsoft-Windows-Security-Auditing: (no user): no domain: DZYPTR1-CONFROOM: Windows Firewall did not apply the following rule: Rule Information: ID: RemotePrivNetwork Outbound Default Rule Name: RemotePrivNetwork Outbound Default Rule Error Information: Reason: Remote Addresses resolved to an empty set.


I didn't find any rule in firewall that indicates this error so I could disable it. I know for example about this error "CoreNet-Teredo-In Name: Core Networking - Teredo (UDP-In) Error Information: Reason: Local Port resolved to an empty set" and I was able to find it and disable from firewall rules but the one that above I have no idea. I tried with cmd command to disable but it can't find RemotePrivNetwork Outbound rule.


This error I see in our network on almost all machines. The network is not domain just regular workgroup and regular LAN. This error particularly I get from fresh installed Windows 10 (doesn't matter which build - 1703, 1709...1903).

If anyone can give me any clue I would highly appreciate.


Thanks in advance.

:)

 

Windows 10 Tweaks

Pressing “Windows+Pause Break” (it’s up there next to scroll lock) opens the “System” Window.

Windows 10: In the new version of Windows, Explorer has a section called Quick Access. This includes your frequent folders and recent files. Explorer defaults to opening this page when you open a new window. If you’d rather open the usual This PC, with links to your drives and library folders, follow these steps:

• Open a new Explorer window.
• Click View in the ribbon.
• Click Options.
• Under General, next to “Open File Explorer to:” choose “This PC.”
• Click OK

credit to Lifehacker.

 

firewall alerts even with advanced rules applied


I don't know, it's been a really long time since I've used FTP and even then didn't use it much, so I can't help you. From memory there are two types of FTP, Passive and Active. One of them (Passive I think) doesn't just use Ports 20 and 21, but assigns a different Port number for the data transfer. Maybe that is what's being blocked? Alternatively, maybe the router or ISP is blocking the connection?

However, if you think the problem is due to Windows Firewall (and Windows Firewall isn't asking you whether to allow an incoming connection or not), then you need to see exactly what is being blocked so that you can then add/modify your rules accordingly. Windows doesn't make that particularly user-friendly, but this is how you enable logging:

Go to Group Policy Editor and enable logging of blocked connections:

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access > Audit Filtering Platform Connection > Tick 'Failure'






Then go to Event Viewer and set it up to view those blocked connections:

Event Viewer > Custom Views > Right-click > Create Custom View > XML tab > Tick 'Edit Query Manually'





Paste the following:

Windows Firewall Blocked Inbound (All):
Code:

Code:

<QueryList>    <Query Id="0" Path="Security">      <Select Path="Security">*[System[(EventID=5150 or EventID=5157)]]     and *[EventData[Data[@Name="Direction"]="%%14592"]]  </Select>    </Query>  </QueryList>

Then repeat the above steps for Outbound connections too.

Windows Firewall Blocked Outbound (All):
Code:

Code:

<QueryList>    <Query Id="0" Path="Security">      <Select Path="Security">*[System[(EventID=5150 or EventID=5157)]]     and *[EventData[Data[@Name="Direction"]="%%14593"]]  </Select>    </Query>  </QueryList>

This will show you everything that's being blocked by Windows Firewall, so you will need to sort through the entries to find the ones that could be related to your FTP problem and add/modify rules accordingly. 'Protocol' numbers shown in the logs are documented at THIS LINK (TCP = 6, UDP = 17)

 

Windows 10 Firewall won't keep my inbound/outbound rules

Hi,

I realize the inconvenience caused to you regarding the Windows Firewall. I will certainly assist you.

I suggest you to restart the Windows firewall service and check if it helps.

Follow the below steps for the same.

• Press Windows key + R simultaneously for Run.
• Type services.msc and then Enter.
• Right click on the Windows firewall services and then restart the services and check if it helps.

If the issue still persists then I suggest you to remove and then read the Windows fire wall rule.

Hope this information is helpful. Please get back to us with the information required, if you need further assistance, we’ll be glad to assist you.