Blocked connections

On Windows 7 and 8, enable auditing of failed connections.

Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy > Audit object access : Failure

Dropped connections, with the corresponding executable name, show at:

Event log > Windows Logs > Security

• The Windows Filtering Platform has blocked a packet — Event Id 5152.
• The Windows Filtering Platform has blocked a connection — Event Id 5157.

Application Name example:

\device\harddiskvolume2\program files\xyz.exe