Category Archives: sysadmin

Monitoring Windows advanced Firewall Rule changes

Starting with Windows Vista and Windows 2008, if you want to see who and when changes Windows Firewall with Advanced Security rules and other settings you must enable either the “Policy Changes” auditing category or rather the “Filtering Platform Policy Change” and “Other Policy Change Events” auditing subcategories. Afte you have enabled this auditing, system will log success and failure audits into the Security event log whenever any firewall setting changes.

you can enable the auditing with Group Policy, Local Security Policy or from command line:

auditpol /set /subcategory:”Filtering Platform Policy Change” /success:enable /failure:enable
auditpol /set /subcategory:”Other Policy Change Events” /success:enable /failure:enable

How to Track Firewall Activity with the Windows Firewall Log

In the process of filtering Internet traffic, all firewalls have some type of logging feature that documents how the firewall handled various types of traffic. These logs can provide valuable information like source and destination IP addresses, port numbers, and protocols. You can also use the Windows Firewall log file to monitor TCP and UDP connections and packets that are blocked by the firewall.

Source: How to Track Firewall Activity with the Windows Firewall Log

Sysinternals Suite – Windows Sysinternals | Microsoft Docs

Sysinternals Suite

By Mark Russinovich
Updated: February 18, 2019
Download Sysinternals Suite (23.2 MB)
Download Sysinternals Suite for Nano Server (4.6 MB)

Introduction

The Sysinternals Troubleshooting Utilities have been rolled up into a single Suite of tools. This file contains the individual troubleshooting tools and help files. It does not contain non-troubleshooting tools like the BSOD Screen Saver.

The Suite is a bundling of the following selected Sysinternals Utilities: AccessChkAccessEnumAdExplorerAdInsightAdRestoreAutologonAutorunsBgInfoBlueScreenCacheSetClockResContigCoreinfoCtrl2CapDebugViewDesktopsDisk2vhdDiskExtDiskMonDiskViewDisk Usage (DU)EFSDumpFindLinksHandleHex2decJunctionLDMDumpListDLLsLiveKdLoadOrderLogonSessionsMoveFileNotMyFaultNTFSInfoPageDefragPendMovesPipeListPortMonProcDumpProcess ExplorerProcess MonitorPsExecPsFilePsGetSidPsInfoPsKillPsListPsLoggedOnPsLogListPsPasswdPsPingPsServicePsShutdownPsSuspendPsToolsRAMMapRegDelNullRegHideRegJumpRegistry Usage (RU)SDeleteShareEnumShellRunasSigcheckStreamsStringsSyncSysmonTCPViewVMMapVolumeIDWhoIsWinObjZoomIt

Download Sysinternals Suite (22.6 MB)
Download Sysinternals Suite for Nano Server (4.7 MB)

 

Source: Sysinternals Suite – Windows Sysinternals | Microsoft Docs

How to Disable Windows 10 Update in Every Way – EaseUS

 

Change the way Windows 10 Updates Using Registry

Customize a Windows 10 update without receiving any forced updates on your computer. Here’s how to make the change in Registry:

1. Use the Windows key + R keyboard shortcut to open the Run command.

2. Type regedit, and click OK to open the Registry.
Browse the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows

3. Right-click the Windows (folder) key, select New, and then click Key.

4. Name the new key WindowsUpdate and press Enter.

5. Right-click the newly created key, select new, and click Key.

disable windows 10 update in registry

6. Name the new key AU and press Enter.
Inside the newly created key, right-click on the right side, select New, and click on DWORD (32-bit) Value.

7. Name the new key AUOptions and press Enter.
Double-click the newly created key and change its value to 2. It’s for “Notify for download and notify for install”. Click OK.

8. Close the Registry to complete the task.

Using this value prevents Windows 10 from downloading updates automatically, and you’ll get a notification when new updates are available. By this way, you can avoid any auto Windows 10 update effectively.

Source: How to Disable Windows 10 Update in Every Way – EaseUS