Windows Firewall rules automatically deleted

Hi,

It looks like the firewall rules are being deleted, which could be related to app updates or changes. Here's what to consider:

1. Rule Deletions:
   • The deleted rules are linked to Microsoft Outlook and other Windows communications apps. These might be removed as part of an app update or configuration change.
   Possible Causes: Normal app updates or changes in settings might delete old rules.

     If the deletions happen unexpectedly or repeatedly without any app updates, this could be suspicious.
   

Actions to Take:

Check for App Updates: Confirm if these deletions align with app update times.

Review Logs: Use Microsoft Sentinel to monitor Windows Event Logs for any related activity.

Set Alerts: Track firewall changes to spot patterns or suspicious behavior.

✨ Please Upvote and Accept the Answer if it helps! ✨

Thanks & Regards,
Tasadduq Burney
(Microsoft MVP & MCT)
(Azure 15x)

Hi Kamesh Patil,

Thanks for your post. Basically, we can see the firewall activity in Windows Defender Firewall Logs. We may find this info on a target by logging the dropped packets while replicating the steps in PDQ Deploy or Inventory that we are receiving the error or connection problems.

Enable Manually

To manually enable logging dropped packets on a failing target:

1. Launch the Windows Firewall Console on the Target Computer.
2. Select the Windows Defender Firewall tab and click Properties in the Actions menu.
3. Inside the Properties tab, select the Customize button under Logging.
4. Select Yes in the Log Dropped Packets dropdown menu.
5. Press OK to close the Logging Settings menu and again to close the Windows Defender Firewall Properties.

Enable with PowerShell

Set-NetFirewallProfile -Profile Domain -LogBlocked TrueCopy

Accessing the logs

Once logging is enabled, verify you are able to read the log file. If not, open the Log Files Security tab and enable Read permissions for your account.

You can find the logs at the following path:C:\Windows\System32\LogFiles\Firewall

By default, the log is named pfirewall.log

After verifying the log can be opened and read, attempt to replicate the error received. You may need to close and reopen the file after each test to see updates

If the firewall is in Azure, you can follow the guide for Azure monitoring.

MonitorAzure Firewall | Microsoft Learn

Best Regards,

Ian Xue

If the Answer is helpful, please click "Accept Answer" and upvote it.