Windows 8.1 Firewall + Microsoft Account Logon

Question

Hi,
I am a frequent SkyDrive user. With Windows 8.1, the SkyDrive integration has changed. In order to use SkyDrive, I have to register with my Microsoft account at my local machine now. I am actually fine with that design decision of yours.
But I always used to set the default behavior for outgoing connections in Windows Firewall to "block" and I want to keep it that way because - as a software developer for client/server-apps - I want to be in complete control of which network interface
emits what data packages.
Using the tools from Microsoft SysInternals, I was able to reverse engineer the communication process and determine most of the required rules. But there is one firewall rule that I cannot figure out. Currently, I have the following rules:
General
Predefined: Core Networking - DNS (UDP-Out)
Predefined: Core Networking - Dynamic Host Configuration Protocol (DHCP-Out)
Predefined: Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-Out)
Custom: %ProgramFiles% (x86)\Mozilla Firefox\firefox.exe -> Without limitations, for writing this message!
For SkyDrive:
Custom: %SystemRoot%\System32\SkyDrive.exe -> Without limitations (for the moment)!
Custom: %SystemRoot%\FileManager\FileManager.exe -> Without limitations (for the moment)!
For Microsoft Account Login:
Custom: %SystemRoot%\System32\AuthHost.exe -> Without limitations (for the moment)!
Another rule is required for logging into my Microsoft account successfully. But I cannot figure out what it should look like. The SysInternals Process Monitor shows that that SVCHOST (Network Services Instance / HKLM\System\CurrentControlSet\Services\nsi)
attempts a connect during the Microsoft Account sign-on procedure. However, adding firewall exceptions ("Apply to this Service: ...") for any of the associated services doesn't have any effect. Even creating a rule where "Apply to services only"
is checked doesn't work.
However, setting a rule that allows "This program: %SystemRoot%\System32\svchost.exe" to pass the outgoing firewall works fine. How can it be that a program-executable based rule for SVCHOST.EXE works, while a rule for all services ("Apply
to services only") does not?
I am completely puzzled by this. Is there a hidden service that cannot be seen - even with having the elevated local Administrator credentials - and that is not automatically included when a firewall rule that has "Apply to services only" checked
is created? The most minimalistic (working) rule I could find so far is as follows:
This program: %SystemRoot%\System32\svchost.exe
Protocol Type: TCP
Remote IP Addresses: 131.253.61.80
Other Settings: <default>
However, this is not a setting I want to keep. It is too common. And I also do not want to reference specific hosts directly by their IPs because these IPs might change in the future. Furthermore, creating a exception rule for SVCHOST.EXE produces lots of
warning messages in MMC. Apparently, the Windows Firewall thinks that such a rule can have undesired effects on the firewall subsystem that controls the service based filtering.
I really hope you can help me with this. Thorough online research has shown that other people are also looking for a solution to this problem.
T3L

Answer 1

Hi,
Thanks for posting in Microsoft TechNet forums.
I need more time for testing this issue. There might be some time delay. Appreciate your patience.
Regards,
Kelvin hsu
TechNet Community Support