This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(249.60000000000002, 76%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
OS:Windows Server 2012 R2
Description:
sometimes when using Remote desktop login OS, Advanced firewalls (Domain Profile Settings\Prova Profile Settings\Domain Profile Settings) is automatically enabled(State ON).
Question:
What causes the advanced firewall to automatically turn on?
Advanced firewalls default State is OFF:
netsh advfirewall show allprofiles
State OFF
Firewall Policy BlockInbound,BlockOutbound
LocalFirewallRules N/A (GPO-store only)
LocalConSecRules N/A (GPO-store only)
InboundUserNotification Disable
RemoteManagement Not Configured
UnicastResponseToMulticast Enable
Logging:
LogAllowedConnections Disable
LogDroppedConnections Disable
FileName %systemroot%\system32\LogFiles\Firewall\pfirewall.log
MaxFileSize 4096
State OFF
Firewall Policy BlockInbound,BlockOutbound
LocalFirewallRules N/A (GPO-store only)
LocalConSecRules N/A (GPO-store only)
InboundUserNotification Disable
RemoteManagement Not Configured
UnicastResponseToMulticast Enable
Logging:
LogAllowedConnections Disable
LogDroppedConnections Disable
FileName %systemroot%\system32\LogFiles\Firewall\pfirewall.log
MaxFileSize 4096
State OFF
Firewall Policy BlockInbound,BlockOutbound
LocalFirewallRules N/A (GPO-store only)
LocalConSecRules N/A (GPO-store only)
InboundUserNotification Disable
RemoteManagement Not Configured
UnicastResponseToMulticast Enable
Logging:
LogAllowedConnections Disable
LogDroppedConnections Disable
FileName %systemroot%\system32\LogFiles\Firewall\pfirewall.log
MaxFileSize 4096
Ok.
Might check for clues in
Applications and Services logs\Microsoft\Windows\Windows Firewall with Advanced Security\Firewall log
--please don't forget to Accept as answer if the reply is helpful--
logpath:Applications and Services logs\Microsoft\Windows\Windows Firewall with Advanced Security\Firewall log
i can not find it,where's the logs?
Start|Run eventvwr.msc
--please don't forget to Accept as answer if the reply is helpful--
maybe at 202-10-10 11:50:00, the advanced firewall to automatically turn on.
What is dllhost?
Modifying Application: C:\Windows\System32\dllhost.exe
Likely because of the 2010 events. Profile change. Possibly something with the connection properties itself is changing.
--please don't forget to Accept as answer if the reply is helpful--
@佳宝 张 Hi,
Thank you for posting in Q&A!
Since the specific reason why the advanced firewall to automatically turn on need to be analyzed through the logs.
Disabling windows firewall services would cause disconnection with server . But If you need to turn off the Windows Firewall with Advanced Security (wf.msc) you may do this via administrator command prompt:
netsh advfirewall set allprofiles state off
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Since the specific reason why the advanced firewall to automatically turn on need to be analyzed through the logs.
What logs do I need to analyze??
Windows Firewall with Advanced Security\Firewall log under:
What's more, have you ever tried the command I provided?
netsh advfirewall set allprofiles state off already run it
Hi，
Please monitor for some time to see whether the " automatically turn on" issue will happen again.
It has happened several times