Windows Firewall refusing connections unless logging turned on

windows-firewallwindows-server-2008-r2

From the Windows Mystery Caves:

a user trying to access a Windows Server 2008 R2 Remote Desktop Session Host is getting network timeouts upon connection establishment attempts. The Remote Desktop exception has been enabled and restricted (among other subnets) to the remote subnet 192.168.202.0/23. The user host's IP address is 192.168.203.63. The firewall log does not contain dropped connection attempt entries with this IP address.

If I change the Windows Firewall Logging settings for the domain profile and enable the logging of successful attempts like this,

enter image description here

connections start to establish successfully and are logged with "ALLOW" entries in the firewall log. Disabling the logging of successful attempts breaks the user's connection establishment again. Another user's machine with a host IP address of 192.168.203.71 seems unaffected and can initiate connections even with logging disabled.

WTH? What exactly is the logging setting changing aside from actually enabling logging?

Best Answer

Try to lower security settings for Remote Desktop connection at Control Panel - System and Security - (section System) Allow remote access. It opens windows System Properties on tab Remote. On the lower part of window is group Remote Desktop, where you can set Remote Desktop security level. Try to change it from Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure) to Allow connections from computers running any version of Remote Desktop (less secure)

Related Solutions

Windows – Does Windows Firewall have the ability to log which exe is blocked

p0rkjello answered correctly but left key things, after struggling for hours I found the solution.

Open CMD with administrator privilege, paste command auditpol /set /subcategory:"{0CCE9226-69AE-11D9-BED3-505054503030}" /success:disable /failure:enable
Open event viewer and go to Windows logs > Security
From right side panel select Filter log > Keywords > Select "Audit failure"

Information that can be found here are application name, destination IP, connection direction and more

Edit: On 9th April 2020

I got an easier way to check event log using PowerShell command below

Get-EventLog security -newest 10 -InstanceId 5157 -Message *Destination* |  Select @{Name="message";Expression={ $_.ReplacementStrings[1] }}

Replace newest 10 with number of entries you want to search
Select @{Name="message";Expression={ $_.ReplacementStrings[1] }} extracts application name.

Ftp – Windows Server 2008 r2 FTP blocking outside connections

can you show the relevant rules with command

netsh advfirewall firewall show rule name=all

what you basically want is for active ftp ports 21 incoming (from any port), and port 20 (data) outgoing to any port. For passive ftp, you'd need to allow incoming ports of the given range (set up on IIS) and allow them in the firewall too.

have a look at this guide Configuring FTP Firewall Settings in IIS 7 i think it'll be very helpful.

Best Answer

Related Solutions

Windows – Does Windows Firewall have the ability to log which exe is blocked

Ftp – Windows Server 2008 r2 FTP blocking outside connections

Related Topic