Vista - Does anyone know about this Firewall error ??

Good afternoon everyone,

I'm a home user, and I notice that I'm getting many of these errors in the
event viewer. I can't find where this error is coming from. Does anyone
know what this is ? All my internet apps (mail, web, chat) seem to work
fine.

"Windows Firewall was unable to notify the user that it blocked an
application from accepting incoming connections on the network. (Error
Code: 2, Event ID: 5032, Source: security-auditing) "

I tried looking up 5032 in Microsoft's error lookup page, but found nothing.

Thanks for any insight you can provide, sincerely,

Paul

This happens when a service is blocked from receiving inbound traffic. The
firewall only notifies the user when an interactive program is blocked.

If you open the event and look at the details you will see a Process ID.
That process ID will tell you which process was blocked. You can determine
the name of the process using Task Manager (hit CTRL+SHIFT+ESC to launch it).
There is also a thread ID there. If you are inclined to go debugging you can
use that to figure out more specifically what was blocked. Keep in mind,
however, that process IDs are ephemeral and will change when the process is
restarted.
---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"Paul & Lucy" wrote:

> Good afternoon everyone,
>
> I'm a home user, and I notice that I'm getting many of these errors in the
> event viewer. I can't find where this error is coming from. Does anyone
> know what this is ? All my internet apps (mail, web, chat) seem to work
> fine.
>
> "Windows Firewall was unable to notify the user that it blocked an
> application from accepting incoming connections on the network. (Error
> Code: 2, Event ID: 5032, Source: security-auditing) "
>
> I tried looking up 5032 in Microsoft's error lookup page, but found nothing.
>
> Thanks for any insight you can provide, sincerely,
>
> Paul
>
>
>
>
>

Thanks for the insight Jesper. I did as you suggested. The task manager
shows that the process is called "Isass.exe" which is the "local security
authority process" and is part of the RPC (remote procedure call) process.
The service that are associated with it is something called "CNG Key
Isolation" (KeyIso). Don't know what to do here.

It was also mentioned that this error can come up when the computer doesn't
have enough memory to notify the user.

___________________________________

"Jesper" <Jesper@discussions.microsoft.com> wrote :
> This happens when a service is blocked from receiving inbound traffic. The
> firewall only notifies the user when an interactive program is blocked.
>
> If you open the event and look at the details you will see a Process ID.
> That process ID will tell you which process was blocked. You can determine
> the name of the process using Task Manager (hit CTRL+SHIFT+ESC to launch
> it).
> There is also a thread ID there. If you are inclined to go debugging you
> can
> use that to figure out more specifically what was blocked. Keep in mind,
> however, that process IDs are ephemeral and will change when the process
> is
> restarted.
> ---
> Your question may already be answered in Windows Vista Security:
> http://www.amazon.com/gp/product/047...otectyourwi-20
>

It is actually kind of the other way around. Think of LSASS as the "executive
branch" of security on your computer. It enforces all the rules around
security, including authentication, access checks, etc. It uses RPC for many
of its calls.

I have never heard this may happen when the computer has insufficient
memory, but maybe it could. In this particular case it is most definitely a
service that received data that the firewall blocked. It could be malicious
or benign. Without sniffing to find out you won't know. It can actually be as
simple as LSASS calling into itself (which is quite common) using a network
API. Upon failure it can retry with a local call.

I would not worry about it though. It is quite normal to see these. Over the
last two days I have 29 of these. Most or all are related to LSASS. I have
noticed no stability problems with it, and in any case, there is insufficient
information in the event log message to act on it.

---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"Paul & Lucy" wrote:

> Thanks for the insight Jesper. I did as you suggested. The task manager
> shows that the process is called "Isass.exe" which is the "local security
> authority process" and is part of the RPC (remote procedure call) process.
> The service that are associated with it is something called "CNG Key
> Isolation" (KeyIso). Don't know what to do here.
>
> It was also mentioned that this error can come up when the computer doesn't
> have enough memory to notify the user.
>
> ___________________________________
>
> "Jesper" <Jesper@discussions.microsoft.com> wrote :
> > This happens when a service is blocked from receiving inbound traffic. The
> > firewall only notifies the user when an interactive program is blocked.
> >
> > If you open the event and look at the details you will see a Process ID.
> > That process ID will tell you which process was blocked. You can determine
> > the name of the process using Task Manager (hit CTRL+SHIFT+ESC to launch
> > it).
> > There is also a thread ID there. If you are inclined to go debugging you
> > can
> > use that to figure out more specifically what was blocked. Keep in mind,
> > however, that process IDs are ephemeral and will change when the process
> > is
> > restarted.
> > ---
> > Your question may already be answered in Windows Vista Security:
> > http://www.amazon.com/gp/product/047...otectyourwi-20
> >
>
>
>

I'm glad I don't have to worry about it, because it would otherwise one heck
of a problem to crack. I was just going through the event viewer to see
what errors are in there and trying to see which ones are important and
which ones aren't.

Thanks once again,

Paul
__________________________________

"Jesper" <Jesper@discussions.microsoft.com> wrote in message
news:0238925D-0C6F-410B-9B5A-7181A553BA4D@microsoft.com...
> It is actually kind of the other way around. Think of LSASS as the
> "executive
> branch" of security on your computer. It enforces all the rules around
> security, including authentication, access checks, etc. It uses RPC for
> many
> of its calls.
>
> I have never heard this may happen when the computer has insufficient
> memory, but maybe it could. In this particular case it is most definitely
> a
> service that received data that the firewall blocked. It could be
> malicious
> or benign. Without sniffing to find out you won't know. It can actually be
> as
> simple as LSASS calling into itself (which is quite common) using a
> network
> API. Upon failure it can retry with a local call.
>
> I would not worry about it though. It is quite normal to see these. Over
> the
> last two days I have 29 of these. Most or all are related to LSASS. I have
> noticed no stability problems with it, and in any case, there is
> insufficient
> information in the event log message to act on it.
>
> ---
> Your question may already be answered in Windows Vista Security:
> http://www.amazon.com/gp/product/047...otectyourwi-20
>
>
> "Paul & Lucy" wrote:
>
>> Thanks for the insight Jesper. I did as you suggested. The task manager
>> shows that the process is called "Isass.exe" which is the "local security
>> authority process" and is part of the RPC (remote procedure call)
>> process.
>> The service that are associated with it is something called "CNG Key
>> Isolation" (KeyIso). Don't know what to do here.
>>
>> It was also mentioned that this error can come up when the computer
>> doesn't
>> have enough memory to notify the user.
>>
>> ___________________________________
>>
>> "Jesper" <Jesper@discussions.microsoft.com> wrote :
>> > This happens when a service is blocked from receiving inbound traffic.
>> > The
>> > firewall only notifies the user when an interactive program is blocked.
>> >
>> > If you open the event and look at the details you will see a Process
>> > ID.
>> > That process ID will tell you which process was blocked. You can
>> > determine
>> > the name of the process using Task Manager (hit CTRL+SHIFT+ESC to
>> > launch
>> > it).
>> > There is also a thread ID there. If you are inclined to go debugging
>> > you
>> > can
>> > use that to figure out more specifically what was blocked. Keep in
>> > mind,
>> > however, that process IDs are ephemeral and will change when the
>> > process
>> > is
>> > restarted.
>> > ---
>> > Your question may already be answered in Windows Vista Security:
>> > http://www.amazon.com/gp/product/047...otectyourwi-20
>> >
>>
>>
>>
>

"Thomas Krogstad" wrote in message
news:2008101993334thomas_krogstad@xxxxxxPlease note:
This is NOT a chat room and You are NOT posting to a forum run by
Eggheadcafe - you are actually posting to a global Usenet Newsgroup. You
will get a far better experience if you use a newsreader and subscribe to
these groups directly, rather than through Eggheadcafe.

Setting up Outlook Express/Windows Mail to access Microsoft newsgroups
http://www.michaelstevenstech.com/ou...snewreader.htm

Accessing the MS newsgroups in Outlook Express/Windows Mail Newsreader
http://www.microsoft.com/windowsxp/e...roupsetup.mspx

If you must stay with Egghheadcafe then please follow Usenet custom by
quoting the post you are replying to, and replying to the thread.

Thank you.

http://dts-l.net/goodpost.htm