主页 » 启用Windows Firewall日志
为了监控 Windows 防火墙日志，请添加要从中收集防火墙日志的Windows 设备。
要使EventLog Analyzer收集Windows防火墙日志，请修改添加的Windows设备的本地审核策略并启用与防火墙相关的事件。请按照以下步骤执行此操作。
auditpol.exe /set /category:"Policy Change" /subcategory:"MPSSVC rule-level policy change" /success:enable /failure:enable
auditpol.exe /set /category:"Policy Change" /subcategory:"Filtering Platform policy change" /success:enable /failure:enable
auditpol.exe /set /category:"Logon/Logoff" /subcategory:"IPsec Main Mode" /success:enable /failure:enable
auditpol.exe /set /category:"Logon/Logoff" /subcategory:"IPsec Quick Mode" /success:enable /failure:enable
auditpol.exe /set /category:"Logon/Logoff" /subcategory:"IPsec Extended Mode" /success:enable /failure:enable
auditpol.exe /set /category:"System" /subcategory:"IPsec Driver" /success:enable /failure:enable
auditpol.exe /set /category:"System" /subcategory:"Other system events" /success:enable /failure:enable
auditpol.exe /set /category:"Object Access" /subcategory:"Filtering Platform packet drop" /success:enable /failure:enable
auditpol.exe /set /category:"Object Access" /subcategory:"Filtering Platform connection" /success:enable /failure:enable
