Windows 10: Windows Firewall rules being modified/added then immediately deleted

Essentially we have been seeing many different logs for "A rule was modified" EVID 4947 in the Windows Firewall, the rule name and rule ID are GUIDs which lead us to believe the rules being modified weren't initially created by a user. When looking for the modified rule on the host itself, the rule seemed to not exist. We then discovered that immediately after being modified, the rule was deleted EVID 4948, which explains why we couldn't find it on the host.


The logs don't offer much in terms of root-cause. We want to understand why Firewall rules are being modified, then immediately deleted. It should also be noted, we have see the exact same activity except instead of modified, a rule is added then deleted.


My initial theory is that applications are causing this behaviour, or perhaps even GPO rules. It's important for us to understand why this activity is happening and whether it's normal because we would like to monitor when rules are modified/deleted/added outside of normal behaviour - an example use-case being a user/malware creates a firewall exception to communication with a C2C server.


Thanks for any assistance.

:)

 

Windows Defender Firewall - Rules without a Group - Unable to remove or modify.

I have some outbound rules in Windows Defender Firewall which I put on/in.

They have no "Group" though others I have put up have managed to find them selves a Group. These without a Group I have been unable to Delete or Modify.

They have on them (in properties) "this rule has been applied by the system administrator and cannot be modified".


I have tried resetting the rules to those loaded at setup and it does
remove my other rules, but not these without a Group.

 

Windows 10 Firewall won't keep my inbound/outbound rules

Hi,

I realize the inconvenience caused to you regarding the Windows Firewall. I will certainly assist you.

I suggest you to restart the Windows firewall service and check if it helps.

Follow the below steps for the same.

• Press Windows key + R simultaneously for Run.
• Type services.msc and then Enter.
• Right click on the Windows firewall services and then restart the services and check if it helps.

If the issue still persists then I suggest you to remove and then read the Windows fire wall rule.

Hope this information is helpful. Please get back to us with the information required, if you need further assistance, we’ll be glad to assist you.

 

Windows Firewall Forgetting Rules

I've recently installed the latest version of Windows 10 in my PC. I've blocked and allowed some softwares in Windows Firewall. But Firewall keeps forgetting the rules in 1/2 days. For example, I've allowed Pro Evolution Soccer 2016 in Firewall. But in a
few days, when I open the game, firewall sends message asking if I want to allow that app or not. Then after checking the allowed apps, I do not see that game in the list, which means firewall didn't remember the settings.

Also, I blocked KMPlayer in firewall to prevent it from connecting to internet (it shows too much ads otherwise). So, I created inbound and outbound rules for KMPlayer and blocked the connection. After that, it was all okay for two days, then again it started
showing ads, and then checking the rules, I didn't notice the rules there which I created two days ago. And this thing keeps happening. I make the inbound and outbound rules for KMPlayer, it stays all okay for a few days, and then it forgets again.

So, what is wrong with the firewall and what is the solution of it?

[Moved from: Windows / Windows 10 / Windows settings]