Working notes on Firewall: Log blocked outgoing connections.
Audit failed object access on Windows 7 and 8 and read WFP block events 5152 and 5157.