Windows Firewall and unwanted rules being auto created

Question

When i activated the Windows Firewall after switching from Third party software i encountered something weird. The firewall created several New rules that blocked certain traffic.
Is their any circumstances where the Windows firewall will Auto create rules that Block traffic?
Is there any way to prevent this from happeneing? I want to know what happens in my firewall :)
I have disabled the prompt that asks the user to allow traffic, but still i dont feel that i have full Control of the firewalls behaviour. Could disabling this feature being the cause of Things being auto blocked?

Answer 1

You can try looking in Event Log: Applications and Services -> Microsoft-> Windows -> Windows Firewall -> Firewall
For list of event id's you can try looking at
https://technet.microsoft.com/en-us/library/dd364427(v=ws.10).aspx
You can use Event Viewer to create a filter for event id 2004 (A rule has been added to the Windows Firewall exception list.) or you could modify the powershell script you can find here
http://superuser.com/questions/747184/is-there-anyway-to-see-when-a-windows-firewall-rule-was-created-enabled-using-po
to also include the ModifyingApplication (or any of the values) eg
$Events = Get-WinEvent -ErrorAction SilentlyContinue -FilterHashtable @{logname="Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"; id=2004}
ForEach ($Event in $Events) {
$eventXML = [xml]$Event.ToXml()
For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) {
Add-Member -InputObject $Event -MemberType NoteProperty -Force `
-Name $eventXML.Event.EventData.Data[$i].name `
-Value $eventXML.Event.EventData.Data[$i].'#text'
$Events | Format-Table -Property TimeCreated,RuleName,ModifyingApplication -AutoSize
(You may need to adjust powershell screen buffer width first)