Enbled audit for firewall service

Hi,
Windows Firewall service is automaticall stopped and disabled. I have enbaled audit for success and failre for the below registry path,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
Plesae let me know which event log should i verify which process is disableing firewall service.
regards,
Boopathi S

Hi，
For logs about services, you can open event viewer, then In the left pane, expand Windows Logs and then System. You can filter the logs with Filter Current Log... from the Actions pane on the right and selecting "Service Control Manager." Or, depending on
what you want, you might just need to look through the Error entries.
You can also refer to this blog and see if it helps
http://blogs.technet.com/b/networking/archive/2011/06/14/the-windows-firewall-service-fails-to-start-registry-permissions.aspx
Or it might be caused by any third party application\anti-virus software installed in your system
Yolanda Zhu
TechNet Community Support

Similar Messages

Windows Firewall Service Crashes on Windows Server 2012

Hello Team,
I am facing issues with Windows Firewall Service in new Windows 2012 R2 deployments. when i try to start the Firewall service it wont start and it throws an error message to check the system event logs for information
The Windows Firewall service terminated with the following service-specific error:
The data is invalid.
I deployed this OS on a VM running with latest VM tools and HW version which is running on ESXi 5.1 U1
2 GB RAM, 1 vCPU
OS deployed through ISO downloaded from MS portal and License activated through KMS system, performed a couple of reboots as well.
any advise on this issue? i am sure some of you might have also faced the same issue

1. VMware support forum and knowledge base may give you more specific advice.
2. Windows services may be dependent on another service(s). Analyze these dependences. Do it after you understand implications of VMware firewall function.
3. More detailed info from Event log is needed for analysis (Event ID, etc)
4. Hope you have connectivity configured correctly.
5. For firewall in VMware read the following article(s):
http://pubs.vmware.com/vsphere-51/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc%2FGUID-52188148-C579-4F6A-8335-CFBCE0DD2167.html&__utma=207178772.2027713003.1393320147.1393320147.1393320147.1&__utmb=207178772.0.10.1393320147&__utmc=207178772&__utmx=-&__utmz=207178772.1393320147.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)&__utmv=-&__utmk=174193441
Regards
Milos

ICal Error: "No virtual host found for iCal Service" - Help!

Trying to set up iCal on OS X Server 10.5.6
Server is up and running and successfully providing web services on its FQDN. Server is not currently used to support network users / services, but as and when it does it will be the Master Opendirectory server.
I have created a couple of test accounts on the server (simply in the Users group) and enabled both for Calendar Access.
I have provided the details of the FQDN on the iCal page, and checked that the default port (8008) has been opened in the firewall.
In web services there is one virtual domain (using name based virtual server) and the default domain in operation. Both appear to be functioning as would be expected.
When I click on 'start service' for iCal, I get this error.
"No virtual host found for iCal service"
I cannot find any information about this in iCal manual, or online documentation. Can anyone here provide pointer to where this information is, or what it means?
Would be most grateful.

Hey there,
See if any of the solutions provided in either of these older threads can steer you in the right direction.
http://discussions.apple.com/thread.jspa?threadID=1201737
http://discussions.apple.com/thread.jspa?threadID=1242823&start=0&tstart=-3
B-rock

How do I identify the latest file modifications, application install, and registry key modification for Security Forensics.... using GP Audit for registry/file system

Hello,
Title pretty much states it all. I initially set out (as part of a Security Forensics initiative) to identify the most recently installed applications, modified files, and registry key changes using PowerShell. I attempted to pull this information and sort
them by date installed/last modified, but it was brought to my attention this information isn't always present and can be modified - so it's not accurate.
At that time it was suggested we use Group Policy auditing for Registry and File System - but I'm not sure how I'm going to use/pull these in PowerShell? This will be used on remote host all over the world so local physical access isn't an option.
My question is:
Once Group Policy Auditing for Registry and File System has been enabled, how would I go about pulling those audit logs for review once a system has been identified as compromised? I'm brand new to this GP Auditing (we have a separate team for that) so feel
free to take it from the beginning. :)
Thanks in advance!

Hi,
Here are a few suggestions for you:
Ensure Remote Registry service is started on local and remote machines.
Add the – Credential option and supply administrative credentials within the command.
More information for you:
Get-Eventlog doesn't work against Vista/W7 clients
https://social.technet.microsoft.com/Forums/en-US/c5185a01-b0d2-49a7-9aa7-52e6534ada04/geteventlog-doesnt-work-against-vistaw7-clients?forum=winserverpowershell
PowerShell - How to Get XML EventData - Remote Eventlogs - Exchange Events
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/382b10c9-d740-46b1-b81c-b24de911eb14/powershell-how-to-get-xml-eventdata-remote-eventlogs-exchange-events-?forum=ITCG
Powershell script to gather failed logon attempts by event id and type from the security events log
https://social.technet.microsoft.com/Forums/scriptcenter/es-ES/00a62492-c63a-4c8b-92f9-1cc857223a00/powershell-script-to-gather-failed-logon-attempts-by-event-id-and-type-from-the-security-events-log?forum=ITCG
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Crawl log error in sharepoint 2013 for search services

Dear Support,
please find below mention crawl log error in sharepoint 2013 for search services.
8,597 The server is unavailable and could not be accessed. The server is probably disconnected from the network.
423 This item could not be crawled because the repository did not respond within the specified timeout period. Try to crawl the repository at a later time, or increase the timeout value on the Proxy and Timeout page in search administration. You might also
want to crawl this repository during off-peak usage times.
59 Processing this item failed because of a timeout when parsing its contents.
11 The filtering process has been terminated
4 SharePoint returned an empty response.
3 The crawler could not communicate with the server. Check that the server is available and that the firewall access is configured correctly.
2 The crawler could not communicate with the server. Check that the server is available and that the firewall access is configured correctly. If the repository was temporarily unavailable, an incremental crawl will fix this error.
would request your support for resolving this type of issue

1. Are you able to browse the sites on SP server. server is unavailable means that application pool
of that site is down. Check application pool on all server. if you start any application pool. make sure it does not stop few minutes later. you need to update password if it does stop
2. Create a disable loopbackcheck of registry on all servers
http://blogs.technet.com/b/sharepoint_foxhole/archive/2010/06/21/disableloopbackcheck-lets-do-it-the-right-way.aspx
http://support.microsoft.com/kb/926642/en-us
3. Create a new search service application and check if you face same issue.
4. I assume you have change some password or other setting when you started facing this issue. what changes were made in environment
If this helped you resolve your issue, please mark it Answered

Firewall service not permitting as it should

The firewall services in OS X Server 10.5.1 are not permitting traffic as expected.
Any ideas here to help me understand why would be appreciated.
IP address block 11.22.33.0/26 has been changed from the original but should have no effect on the example. I don't understand why address 11.22.33.62 hhas no access.
- Steve
root# *serveradmin status ipfilter*
ipfilter:state = "RUNNING"
root# *ipfw list*
00001 allow udp from any 626 to any dst-port 626
01000 allow ip from any to any via lo0
01010 deny log logamount 1000 ip from any to 127.0.0.0/8
01020 deny log logamount 1000 ip from 224.0.0.0/4 to any in
01030 deny log logamount 1000 tcp from any to 224.0.0.0/4 in
12300 allow tcp from any to any established
12301 allow tcp from any to any out
12302 allow tcp from any to any dst-port 22
12302 allow udp from any to any dst-port 22
12303 allow udp from any to any out keep-state
12304 allow tcp from any to any dst-port 53 out keep-state
12304 allow udp from any to any dst-port 53 out keep-state
12305 allow udp from any to any in frag
12306 allow tcp from any to any dst-port 311
12307 allow tcp from any to any dst-port 625
12308 allow udp from any to any dst-port 626
12309 allow icmp from any to any icmptypes 8
12310 allow icmp from any to any icmptypes 0
12311 allow igmp from any to any
12312 allow tcp from any to any dst-port 110
12312 allow udp from any to any dst-port 110
12313 allow tcp from any to any dst-port 25
12313 allow udp from any to any dst-port 25
12314 allow tcp from any to any dst-port 16080
12315 allow ip from 192.168.0.0/24 to any via en0 keep-state
12316 allow udp from any 68 to any dst-port 67 via en0
12317 allow tcp from 11.22.33.0/26 to any dst-port 687
12318 allow tcp from 11.22.33.0/26 to any dst-port 5988,5989
12319 allow tcp from 11.22.33.0/26 to any dst-port 5432
12320 allow tcp from 11.22.33.0/26 to any dst-port 443
12321 allow tcp from 11.22.33.0/26 to any dst-port 3283,5900
12321 allow udp from 11.22.33.0/26 to any dst-port 3283,5900
12322 allow tcp from 11.22.33.0/26 to any dst-port 311
12323 allow tcp from 11.22.33.0/26 to any dst-port 80
12324 allow tcp from 11.22.33.0/26 to any dst-port 8080
12325 allow tcp from 11.22.33.0/26 to any dst-port 749
12325 allow udp from 11.22.33.0/26 to any dst-port 749
12326 allow tcp from 11.22.33.0/26 to any dst-port 88
12326 allow udp from 11.22.33.0/26 to any dst-port 88
12327 allow tcp from 11.22.33.0/26 to any dst-port 600-1023
12327 allow udp from 11.22.33.0/26 to any dst-port 600-1023
65534 deny log logamount 1000 ip from any to any
65535 allow ip from any to any
in /var/log/ipfw.log
Jan 8 11:10:56 ssg4 ipfw[31959]: 65534 Deny TCP 11.22.33.62:63681 192.168.0.5:8008 in via en0

1. Hacked hosts file?
       etc/hosts
        https://discussions.apple.com/docs/DOC-8091
2. Get rid of uTorrent.
3. Reset SMC.     http://support.apple.com/kb/HT3964
    Choose the method for:
    "Resetting SMC on portables with a battery you should not remove on your own".

Apple TV 2 Waiting for network services, unable to sign in to iTunes store

Received my Apple TV yesterday.
It is connected to my network (I have tried wired and wireless).
I can view movie previews and Podcasts.
I cannot sign in to the iTunes Store (therefore cant rent movies), cannot view Youtube videos (No content available), cannot use Netflix (Waiting for network services when I try).
I spoke to Apple support, they couldn't help. They say the problem is with my network or my ISP.
I have a Linksys WRT160N router, on which I have tried disabling the firewall.
My ISP is Telus, I am on their Fibre Optic network in BC. I wonder if Telus are blocking Apple TV?
Anyone else experiencing this?
Message was edited by: gbcecanada
Message was edited by: gbcecanada

I received my Apple TV yesterday.
I am running cable internet with 10Mbps constant.
So I connected it up and proceeded to issue after issue. I could not log into my Apple account. It was stating that my name or password was incorrect.
When I would start the unit it would stay at the waiting for network connections screen for several minutes!
I did all the tricks of turning the apple of and back on, NO FIX.
I tried to update the software, and I recieved a message that stated I have the most updated software, so....NO FIX
I did a full restore. The Apple TV downloaded the newest software and rebooted after about 7 minutes, NO FIX
I logged into my router and opened all ports, added ports 80 and 123, NO FIX
I also disabled my entire firewall on my router and turned off the WEP security feature...and what would you guess.....NO F I X!!
So I logged back into my router and reset all my original settings...still NO FIX.
SO here is the good part...Apparently the system has to connect to time.apple.com and get updated...it's sort of like a verification of the system.
So after it updated everything worked great! No unable to sign into my account. NO waiting on network connections anymore.
So the biggest advice I can give, especially after my 3 hours of gradually wasting my time until I almost threw the unit out my bedroom window, is connect it to your WIFI system and let it sit by itself for a few hours and let it connect to the Apple server.
Hope this helps everyone that, at some point, has shared my pain and frustration.

Firewall service module vs ASA

Hi
Someone told me that the cisco firewall service module of 6500 has poor performances compared to ASA
What do you recommend as a core firewall (to protect internal servers): ASA or firewall service module ?
thanks

Hi,
We are using 5 FWSMs at the moment but are moving away from them to ASA5585-X models.
I wouldnt suggest going to FWSMs anymore at this point if you have any plan on having support for new features.
End Of Life and End of Sale Notice
http://www.cisco.com/en/US/prod/collateral/modules/ps2706/eol_c51-699134.html
The follower for the FWSM is the ASA Service Module which supports the newer softwares (while the FWSM doesnt). Heres a link to a document about the ASASM
http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps11621/data_sheet_c78-672507.html
Also you could always consider a separate ASA models. Here are links to both the orignal ASA 5500 series and new ASA 5500-X series
ASA 5500 Series
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/prod_brochure0900aecd80285492.pdf
ASA 5500-X Series
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/at_a_glance_c45-701635.pdf
I guess the question for you is what are the requirements for the device regarding performance. All of the above documentation should give you a clue about which model might be the best for you.
- Jouni

Need solution for SNMP Service on Solaris

Hi Friends,
We use the solaris servers. For SNMP we have changed the Default Password of SNMP Service.
We audited our Servers doing the Penetration Testing (PT). In this activity it was reported the SNMP is using the default password. They had the tool "Getif" for SNMP testing. If the default password are set for SNMP service this toll reads the important information. If defaults passwords are not used it cannot read any information about SNMP.
When i change the default password for SNMP, should i restart the the service to take changes in effect?
Pls help

Hi taher;
Thanx buddy. You are really helping us out. I just try to share my knowledge wiht forums user i also already learn many thing from forums,as specialy Hussein Sawwan
I have two more doubts. Like in linux we use which command to see if that executable is in the PATH but in Solaris 10 is whence a replacement for that.I belive You can use which command in solaris too.
Q2). I dont think i need to go for split architecture as both the DB (11i) and application tier are certified for solaris *10* SPARC (64-bit).You should decide it not me :) you can use split config if your business need it or not. Its just depend your analysis
I hope; my answer would be answer of your quesition and give you some idea about your issue :)
Regard
Helios

Question on how does load balancing work on Firewall Services Module (FWSM)

Hi everyone,
I have a question about the algorithm of load balancing on Firewall Services Module (FWSM).
I understand that the FWSM supports up to three equal cost routes on the same interface for load balancing.
Please see a lower simple figure.
outside inside
--- L3 SW --+
|
MHSRP +--- FWSM ----
|
--- L3 SW --+
I am going to configure the following default routes on FWSM point to each MHSRP VIP (192.168.13.29 and 192.168.13.30) for load balancing.
route outside_1 0.0.0.0 0.0.0.0 192.168.13.29 1
route outside_1 0.0.0.0 0.0.0.0 192.168.13.30 1　　　　　　
However I don't know how load balancing work on FWSM.
On FWSM, load balancing work based on
Per-Destination ?
Per-Source ?
Per-Packet ?
or
Other criteria ?
Your information would be greatly appreciated.
Best Regards,

Configuring "tunnel default gateway' on the concentrator allowed traffic to flow as desired through the FWSM.
FWSM is not capable of performing policy based routing, the additional static routes for the VPN load balancing caused half of the packets to be lost. As a result, it appears that the VPN concentrators will not be able to load balance.

Help on EBS software for firewalled scenario

Hi,
We have the configuration of a three-tier application on sun v890 servers and each tier sits behind a firewall. i.e. database and application have a firewall in between, web server to application has a firewall and so on.
while configuring backups for the databases we need to know the exact port number that is being used by the EBS backup software for taking the backups or possibility of configuring the minimum number of ports through which the backup can be taken for each server.
Could anybody give a clue to this scenario?
regards,
Ganadeva

Hi,
Refer sun document 819-0286-10.pdf available for download at http://192.18.109.11/819-0286-10/819-0286-10.pdf
As per the sub-section "configuring firewall support" within "server management"
following can be the port allocations for opening the firewall for the service connections:
1) for the backup server
5+2n
n is number of devices registered on the EBS server
for the current configuration having a single LTO3 tape drive device ,
above count comes to 7
starting from 7937+7=7944
2) for every client i.e. every server 2 port 7937 and 7938
3) there is no separate storage node as the backup server is having the server software as well as the direct connection to the tape library.
Refer the page 83 for a possible firewall setting based on above
TCP Packet Considerations
Set firewall rules to allow inbound and outbound TCP packets to and from the
following service ports:
1)On the Sun StorEdge EBS server � open ports between the Sun StorEdge EBS clients and the Sun StorEdge EBS server. ============================>7937-7944
2) On the Sun StorEdge EBS storage node � open ports between the Sun StorEdge EBS clients and the Sun StorEdge EBS storage node. ============================> is the same as storage server in our setup
3) On port 7937 � open the port between the Sun StorEdge EBS server
and both of the following: � Sun StorEdge EBS clients
� Sun StorEdge EBS storage node on the client side of the
firewall
4) On port 7938 � open the port for inbound and outbound requests.
My query is what about the connection ports? The range of 10001 to 30000 is too large from firewall point of view. I have not been able to find a

Generic Host Process For Win32 Services Has Encountered a Problem and Needs to Close - J6480

Computer: eMachines T3025 Athlon
OS: Win XP SP3 (recent clean install)
Printer: HP J6480 on wireless network
Printer prints and scans fine wirelessly. I am using the "small footprint" HP drivers to print and scan.
After some hours with printer connected to the computer wirelessly and printing or scanning, I eventually get the
'Generic Host Process For Win32 Services Has Encountered a Problem and Needs to Close' error message and cannot print or scan any longer unless I shutdown and restart Windows.
I have implemented all the fixes (download, reinstall, etc.) listed for this printer on the hp.com site - namely
http://h10025.www1.hp.com/ewfrf/wc/document?docname=c00273968&tmp_task=solveCategory&lc=en&dlc=en&cc...
with the exception of changing the firewall setttings to allow hpqtra08.exe to run. This file is not found on my system in my install. The files that are allowed to bypass the firewall are shown below (duplicates listed as shown on my screen)
hpoews01.exe
hponicifs01.exe
hponicifs01.exe
hponicifs01.exe
hposid01.exe
hpqkygrp.exe
hpqtax08
hpznui08.exe
hpznui08.exe
hpznui08.exe
Per the Firewall bypass instructions, the files available in the Digital Imaging\bin location on my machine are
hpiscnapp
hpoews01
hposid01
hposvc08
HpqApKil
hpqkygrp
hpqpprop
hpqqpawp
hpqtax08
hpqtbx01
HPqTrMgr
hpqwrg
hpsjrreg
What else do I need to do to solve this problem once and for all ?

Hi,
Please try to update the hot fix then monitory the status again, at same time that error ome times also can cause by virus infection some time please back up important files
update your AV soft then scan the virus.
The relate hot fix:
The Service Host process may stop unexpectedly in Windows Server 2003
http://support.microsoft.com/kb/932762/en-us
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

TMG Microsoft Firewall Service Process (wspsrv.exe) high CPU. CPU Usage 100%

TMG Microsoft Firewall Service Process (wspsrv.exe) high CPU.
CPU Usage 100%
Please help me.
Thanks

Hi,
Since there can be multiple reasons for this issue, you can
capture a manual dump of the wspsrv.exe process on TMG server or find some related logs to better analyze this issue firstly.
In addition, what have you done before you encountered that issue?
If you have any third-party programs installed, you can temporary disable them and restart the firewall service to see if the issue persists.
For more detailed information, please refer to the links below:
How
to capture a manual dump of the wspsrv.exe process on TMG 2010?
Using
DebugDiag 1.2 to Automate Dump Analysis – TMG High CPU Utilization Scenario
Best regards,
Susie

Waiting for network services...

My ATV2 is online, it connected to my network, and all the movie thumbnails and such are displayed. It won't connect to the iTunes store, says that the Apple ID or password aren't recognized. Gets stuck on "Waiting for network services..." on Netflix. When attempting a restore downloads "the latest update" and looks like it's doing what it should but then displays "The update was not successful." Resets don't help, as it gets stuck on the "Waiting for network services..." Anyone having similar problems?

I had the same problem. I just wanted to stream content from Netflix for starters, no bothering with iTunes on a PC, but the aTV2 would be stuck "Waiting for network services". Checking my settings and my router reflected a good WiFi connection, DHCP address assigned, etc. Internet radio worked fine, as did photo screen saver from FlickR.
Attempting to log in to iTunes gave an incorrect password error -- a lamentably bad error since the password was correct.
No joy on Netflix login.
No joy on YouTube. Which is puzzling since port 80 is open. (I wonder if the aTV2 is calling home to Apple even if you are just using Netflix or YouTube.)
All of this is a major annoyance as you have to keep entering your accounts and passwords from scratch over and over with the silly remote control and alphanumeric entry control.
I suspected AppleTV was trying to connect to its services on the internet on some ports my router firewall was blocking, but there is no discoverable, comprehensive, or accurate Apple documentation to indicate what ports those are. I tried opening TCP:3689 with no improvement.
As a last try, I opened every outbound port for the aTV2. (That is not going to be acceptable in the long term. We run a tight network security ship here.) It still didn't work. "Waiting for network services...". Hmph! I powered cycled the aTV2. After it rebooted, it works fine with Netflix and Youtube. No "Waiting..."
It is lamentable that aTV2 setup and/or network test doesn't report what ports it is failing to connect on. Bad bad OOBE Apple! XBOX 360 for example gives much more useful network config assistance.

Script to enable login audit for MS SQL

Hi All,
I want to know if I can edit windows registry for enabling/disabling of login audit for MS SQL.
I need this to incorporate this in a script which would enable login audit when ran.
Thanks,

create login AuditLogin with password = ‘AuditLoginPswd’
go
/*Create a very simple login trigger */
create trigger AuditLogin_Demo
/* server means instance level*/
on all server
with execute as self
/* We specify the logon event at this stage
– If there are more than one connections,
– Issue a rollback*/
for logon
as begin
IF ORIGINAL_LOGIN()= ‘AuditLogin’ AND
(SELECT COUNT(*) FROM sys.dm_exec_sessions
WHERE is_user_process = 1 AND
original_login_name = ‘AuditLogin’) > 1
ROLLBACK;
end
go
Best Regards,Uri Dimant SQL Server MVP,
http://sqlblog.com/blogs/uri_dimant/
MS SQL optimization: MS SQL Development and Optimization
MS SQL Consulting:
Large scale of database and data cleansing
Remote DBA Services:
Improves MS SQL Database Performance
SQL Server Integration Services:
Business Intelligence

Enbled audit for firewall service

Similar Messages

Maybe you are looking for