[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 131
  • Last Modified:

Find a list of applications that a user has blocked?

I'm trying to discover how I can find a list of applications a user has blocked (by accident) under WinXP SP2.  As it stands right now, there doesn't appear to be a way to remove a block that was placed on an application??  It only shows applications that are "exceptions" -- meaning they have been granted access thru the firewall -- there is NO list of applications that have been blocked??

Thanks, Rob.


0
RobAinscough
Asked:
RobAinscough
  • 3
1 Solution
 
r-kCommented:
Are you referring to the Windows Firewall that is included with XP SP2?

I was not aware that you could block individual applications with it.

In any case, if you go to the Windows Firewall dialog, select Adanced, then Security Logging -> Settings maybe you can get some information there.
0
 
RobAinscoughAuthor Commented:
Yes, windows firewall that comes with XP SP2.  When an application is requesting access thru the WinXP firewall, the user is offered a prompt "Unblock" or "Block" the application -- if the user accidently clicks on "Block" then the application will NOT be permitted to communicate thru the firewall.  If the user selects "Unblock" then that application will be stored in a list that can be viewed via Control Panel | Windows Firewall | Exceptions tab -- from here you can add programs that will NOT be blocked in the future.  But what I want to see is a list of programs that are currently being blocked -- this list apparently is NOT available to the user (Admin or otherwise) of that PC.

I'm hoping that "restore defaults" is NOT the way to remove a "blocked" application -- as I'm sure that is a blanket approach to removing ALL blocked applications.

I'll check out the pfirewall.log and see what info it provides.

Rob.
0
 
r-kCommented:
OK, I understand now!

That information is in the Registry, Look in:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

What you will see there is a list of all applications, Enabled as well as Disabled, but the value will tell you which is enabled or disabled.

Note: if you plan to modify that list, also do so in:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

HTH.
0
 
pazmanproCommented:
RobAinscough, you will see the list of exceptions in the location you specified, ie, Control Panel --> Windows Firewall --> Exceptions tab, the application will be listed but without a checkmark (unchecked).
0
 
r-kCommented:
>you will see the list of exceptions in the location you specified, ie, Control Panel --> Windows Firewall --> Exceptions tab, the application will be listed but without a checkmark (unchecked).

 Yes, pazmanpro is right, and that is the much better way to see it.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now