If the Windows Firewall (WF)/Internet Connection Sharing (ICS) service is unable to start, then it adds entries to the system event log with information about why it could not start. Additionally, audit log events corresponding to changes in Windows Firewall configuration and program requests to open ports are stored in the security event log. To view the system or security event logs, use the Event Viewer snap-in.
To view the entries in the system or security event logs with the Event Viewer snap-in, do the following:
Click Start, click Control Panel, click Performance and Maintenance, click Administrative Tools, and then double-click Event Viewer.
To look for error events for the Windows Firewall (WF)/Internet Connection Sharing (ICS) service, click System in the console tree of the Event Viewer snap-in.
In the details pane of the Event Viewer, look for Error events.
To look for audit events corresponding to applications or service attempting to open ports, click Security in the console tree of the Event Viewer snap-in.
In the details pane of the Event Viewer, look for events with the event IDs 849, 850, and 861.
The following figure shows an example of an audit event in the security event log.
|
