From 45339ce0c20b188dd2dba9f1c184f683ce0f4d0b Mon Sep 17 00:00:00 2001 From: Daniel Date: Fri, 25 Feb 2022 15:28:19 +0100 Subject: [PATCH 1/4] Add debug interfaces for wfp and iptables --- compat/debug_default.go | 10 + compat/debug_linux.go | 28 + compat/debug_windows.go | 30 + compat/iptables.go | 60 + compat/iptables_test.go | 24 + compat/wfpstate.go | 528 + compat/wfpstate_test.go | 56270 ++++++++++++++++++++++++++++++++ core/api.go | 6 + netenv/environment_windows.go | 2 +- 9 files changed, 56957 insertions(+), 1 deletion(-) create mode 100644 compat/debug_default.go create mode 100644 compat/debug_linux.go create mode 100644 compat/debug_windows.go create mode 100644 compat/iptables.go create mode 100644 compat/iptables_test.go create mode 100644 compat/wfpstate.go create mode 100644 compat/wfpstate_test.go diff --git a/compat/debug_default.go b/compat/debug_default.go new file mode 100644 index 00000000..82ac6bc3 --- /dev/null +++ b/compat/debug_default.go @@ -0,0 +1,10 @@ +//go:build !windows && !linux + +package compat + +import "github.com/safing/portbase/utils/debug" + +// AddToDebugInfo adds compatibility data to the given debug.Info. +func AddToDebugInfo(di *debug.Info) { + // Not yet implemented on this platform. +} diff --git a/compat/debug_linux.go b/compat/debug_linux.go new file mode 100644 index 00000000..82514509 --- /dev/null +++ b/compat/debug_linux.go @@ -0,0 +1,28 @@ +package compat + +import ( + "fmt" + + "github.com/safing/portbase/utils/debug" +) + +// AddToDebugInfo adds compatibility data to the given debug.Info. +func AddToDebugInfo(di *debug.Info) { + // Get iptables state and add error info if it fails. + chains, err := GetIPTablesChains() + if err != nil { + di.AddSection( + "Compatibility: IPTables Chains (failed)", + debug.UseCodeSection, + err.Error(), + ) + return + } + + // Add data as section. + di.AddSection( + fmt.Sprintf("Compatibility: IPTables Chains (%d)", len(chains)-10), + debug.UseCodeSection|debug.AddContentLineBreaks, + chains..., + ) +} diff --git a/compat/debug_windows.go b/compat/debug_windows.go new file mode 100644 index 00000000..176397f5 --- /dev/null +++ b/compat/debug_windows.go @@ -0,0 +1,30 @@ +package compat + +import ( + "fmt" + "strings" + + "github.com/safing/portbase/utils/debug" +) + +// AddToDebugInfo adds compatibility data to the given debug.Info. +func AddToDebugInfo(di *debug.Info) { + // Get WFP state and add error info if it fails. + wfp, err := GetWFPState() + if err != nil { + di.AddSection( + "Compatibility: WFP State (failed)", + debug.UseCodeSection, + err.Error(), + ) + return + } + + // Add data as section. + wfpTable := wfp.AsTable() + di.AddSection( + fmt.Sprintf("Compatibility: WFP State (%d)", strings.Count(wfpTable, "\n")), + debug.UseCodeSection, + wfpTable, + ) +} diff --git a/compat/iptables.go b/compat/iptables.go new file mode 100644 index 00000000..5ebfc466 --- /dev/null +++ b/compat/iptables.go @@ -0,0 +1,60 @@ +//go:build linux + +package compat + +import ( + "fmt" + + "github.com/coreos/go-iptables/iptables" +) + +var ( + iptProtocols = []iptables.Protocol{ + iptables.ProtocolIPv4, + iptables.ProtocolIPv6, + } + iptTables = []string{ + "filter", + "nat", + "mangle", + "raw", + } +) + +// GetIPTablesChains returns the chain names currently in ip(6)tables. +func GetIPTablesChains() ([]string, error) { + chains := make([]string, 0, 100) + + // Iterate over protocols. + for _, protocol := range iptProtocols { + if protocol == iptables.ProtocolIPv4 { + chains = append(chains, "v4") + } else { + chains = append(chains, "v6") + } + + // Get iptables access for protocol. + tbls, err := iptables.NewWithProtocol(protocol) + if err != nil { + return nil, err + } + + // Iterate over tables. + for _, table := range iptTables { + chains = append(chains, " "+table) + + // Get chain names + chainNames, err := tbls.ListChains(table) + if err != nil { + return nil, fmt.Errorf("failed to get chains of table %s: %w", table, err) + } + + // Add chain names to list. + for _, name := range chainNames { + chains = append(chains, " "+name) + } + } + } + + return chains, nil +} diff --git a/compat/iptables_test.go b/compat/iptables_test.go new file mode 100644 index 00000000..dfec0fae --- /dev/null +++ b/compat/iptables_test.go @@ -0,0 +1,24 @@ +//go:build linux + +package compat + +import ( + "testing" +) + +func TestIPTablesChains(t *testing.T) { + // Skip in CI. + if testing.Short() { + t.Skip() + } + t.Parallel() + + chain, err := GetIPTablesChains() + if err != nil { + t.Fatal(err) + } + + if len(chain) < 35 { + t.Errorf("Expected at least 35 output lines, not %d", len(chain)) + } +} diff --git a/compat/wfpstate.go b/compat/wfpstate.go new file mode 100644 index 00000000..3e3bcf14 --- /dev/null +++ b/compat/wfpstate.go @@ -0,0 +1,528 @@ +package compat + +import ( + "bytes" + "encoding/xml" + "errors" + "fmt" + "io/ioutil" + "os" + "path/filepath" + "sort" + "strings" + "text/tabwriter" + + "github.com/safing/portbase/utils/osdetail" +) + +// GetWFPState queries the system for the WFP state and returns a simplified +// and cleaned version. +func GetWFPState() (*SimplifiedWFPState, error) { + // Use a file to get the wfp state, as the terminal isn't able to return the + // data encoded in UTF-8. + tmpDir, err := os.MkdirTemp("", "portmaster-debug-data-wfpstate") + if err != nil { + return nil, fmt.Errorf("failed to create tmp dir for wfpstate: %w", err) + } + defer func() { + _ = os.RemoveAll(tmpDir) + }() + tmpFile := filepath.Join(tmpDir, "wfpstate.xml") + + // Get wfp state and write it to the tmp file. + _, err = osdetail.RunCmd( + "netsh.exe", + "wfp", + "show", + "state", + tmpFile, + ) + if err != nil { + return nil, fmt.Errorf("failed to write wfp state to tmp file: %w", err) + } + + // Get tmp file contents. + output, err := ioutil.ReadFile(tmpFile) + if err != nil { + return nil, fmt.Errorf("failed to read wfp state to tmp file: %w", err) + } + if len(output) == 0 { + return nil, errors.New("wfp state tmp file was empty") + } + + // Parse wfp state. + parsedState, err := parseWFPState(output) + if err != nil { + return nil, fmt.Errorf("failed to parse wfpstate: %w", err) + } + + // Return simplified and cleaned state. + return parsedState.simplified(), nil +} + +/* +Interesting data is found at: + +providers->item[] + ->displayData->name + ->displayData->description + ->providerKey + +subLayers->item[] + ->displayData->name + ->displayData->description + ->subLayerKey + +layers->item[]->callouts->item[] + ->displayData->name + ->displayData->description + ->calloutKey + ->providerKey + ->applicableLayer + +layers->item[]->filters->item[] + ->displayData->name + ->displayData->description + ->filterKey + ->providerKey + ->layerKey + ->subLayerKey +*/ + +// SimplifiedWFPState is a simplified version of the full WFP state. +type SimplifiedWFPState struct { + Providers []*WFPProvider + SubLayers []*WFPSubLayer + Callouts []*WFPCallout + Filters []*WFPFilter +} + +// WFPProvider represents a WFP Provider. +type WFPProvider struct { + Name string + Description string + ProviderKey string +} + +// WFPSubLayer represents a WFP SubLayer. +type WFPSubLayer struct { + Name string + Description string + SubLayerKey string +} + +// WFPCallout represents a WFP Callout. +type WFPCallout struct { + Name string + Description string + CalloutKey string + ProviderKey string + ApplicableLayer string +} + +// WFPFilter represents a WFP Filter. +type WFPFilter struct { + Name string + Description string + FilterKey string + ProviderKey string + LayerKey string + SubLayerKey string +} + +// Keys returns all keys found in the WFP state. +func (sw *SimplifiedWFPState) Keys() map[string]struct{} { + lookupMap := make(map[string]struct{}, len(sw.Providers)+len(sw.SubLayers)+len(sw.Callouts)+len(sw.Filters)) + + // Collect keys. + for _, provider := range sw.Providers { + lookupMap[provider.ProviderKey] = struct{}{} + } + for _, subLayer := range sw.SubLayers { + lookupMap[subLayer.SubLayerKey] = struct{}{} + } + for _, callout := range sw.Callouts { + lookupMap[callout.CalloutKey] = struct{}{} + } + for _, filter := range sw.Filters { + lookupMap[filter.FilterKey] = struct{}{} + } + + return lookupMap +} + +// AsTable formats the simplified WFP state as a table. +func (sw *SimplifiedWFPState) AsTable() string { + rows := make([]string, 0, len(sw.Providers)+len(sw.SubLayers)+len(sw.Callouts)+len(sw.Filters)) + + // Collect data and put it into rows. + for _, provider := range sw.Providers { + rows = append(rows, strings.Join([]string{ + provider.Name, + "Provider", + provider.Description, + provider.ProviderKey, + }, "\t")) + } + for _, subLayer := range sw.SubLayers { + rows = append(rows, strings.Join([]string{ + subLayer.Name, + "SubLayer", + subLayer.Description, + subLayer.SubLayerKey, + }, "\t")) + } + for _, callout := range sw.Callouts { + rows = append(rows, strings.Join([]string{ + callout.Name, + "Callout", + callout.Description, + callout.CalloutKey, + callout.ProviderKey, + callout.ApplicableLayer, + }, "\t")) + } + for _, filter := range sw.Filters { + rows = append(rows, strings.Join([]string{ + filter.Name, + "Filter", + filter.Description, + filter.FilterKey, + filter.ProviderKey, + filter.LayerKey, + filter.SubLayerKey, + }, "\t")) + } + + // Sort and build table. + sort.Strings(rows) + buf := bytes.NewBuffer(nil) + tabWriter := tabwriter.NewWriter(buf, 8, 4, 3, ' ', 0) + for _, row := range rows { + fmt.Fprint(tabWriter, row) + fmt.Fprint(tabWriter, "\n") + } + _ = tabWriter.Flush() + + return buf.String() +} + +// wfpState is the WFP state as returned by `netsh.exe wfp show state -`. +type wfpState struct { + XMLName xml.Name `xml:"wfpstate"` + Text string `xml:",chardata"` + TimeStamp string `xml:"timeStamp"` + Providers struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []struct { + Text string `xml:",chardata"` + ProviderKey string `xml:"providerKey"` + DisplayData struct { + Text string `xml:",chardata"` + Name string `xml:"name"` + Description string `xml:"description"` + } `xml:"displayData"` + Flags struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item string `xml:"item"` + } `xml:"flags"` + ProviderData string `xml:"providerData"` + ServiceName string `xml:"serviceName"` + } `xml:"item"` + } `xml:"providers"` + SubLayers struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []struct { + Text string `xml:",chardata"` + SubLayerKey string `xml:"subLayerKey"` + DisplayData struct { + Text string `xml:",chardata"` + Name string `xml:"name"` + Description string `xml:"description"` + } `xml:"displayData"` + Flags struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item string `xml:"item"` + } `xml:"flags"` + ProviderKey string `xml:"providerKey"` + ProviderData string `xml:"providerData"` + Weight string `xml:"weight"` + } `xml:"item"` + } `xml:"subLayers"` + Layers struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []struct { + Text string `xml:",chardata"` + Layer struct { + Text string `xml:",chardata"` + LayerKey string `xml:"layerKey"` + DisplayData struct { + Text string `xml:",chardata"` + Name string `xml:"name"` + Description string `xml:"description"` + } `xml:"displayData"` + Flags struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []string `xml:"item"` + } `xml:"flags"` + Field struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []struct { + Text string `xml:",chardata"` + FieldKey string `xml:"fieldKey"` + Type string `xml:"type"` + DataType string `xml:"dataType"` + } `xml:"item"` + } `xml:"field"` + DefaultSubLayerKey string `xml:"defaultSubLayerKey"` + LayerID string `xml:"layerId"` + } `xml:"layer"` + Callouts struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []struct { + Text string `xml:",chardata"` + CalloutKey string `xml:"calloutKey"` + DisplayData struct { + Text string `xml:",chardata"` + Name string `xml:"name"` + Description string `xml:"description"` + } `xml:"displayData"` + Flags struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []string `xml:"item"` + } `xml:"flags"` + ProviderKey string `xml:"providerKey"` + ProviderData string `xml:"providerData"` + ApplicableLayer string `xml:"applicableLayer"` + CalloutID string `xml:"calloutId"` + } `xml:"item"` + } `xml:"callouts"` + Filters struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []struct { + Text string `xml:",chardata"` + FilterKey string `xml:"filterKey"` + DisplayData struct { + Text string `xml:",chardata"` + Name string `xml:"name"` + Description string `xml:"description"` + } `xml:"displayData"` + Flags struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []string `xml:"item"` + } `xml:"flags"` + ProviderKey string `xml:"providerKey"` + ProviderData struct { + Text string `xml:",chardata"` + Data string `xml:"data"` + AsString string `xml:"asString"` + } `xml:"providerData"` + LayerKey string `xml:"layerKey"` + SubLayerKey string `xml:"subLayerKey"` + Weight struct { + Text string `xml:",chardata"` + Type string `xml:"type"` + Uint8 string `xml:"uint8"` + Uint64 string `xml:"uint64"` + } `xml:"weight"` + FilterCondition struct { + Text string `xml:",chardata"` + NumItems string `xml:"numItems,attr"` + Item []struct { + Text string `xml:",chardata"` + FieldKey string `xml:"fieldKey"` + MatchType string `xml:"matchType"` + ConditionValue struct { + Text string `xml:",chardata"` + Type string `xml:"type"` + Uint32 string `xml:"uint32"` + Uint16 string `xml:"uint16"` + RangeValue struct { + Text string `xml:",chardata"` + ValueLow struct { + Text string `xml:",chardata"` + Type string `xml:"type"` + Uint16 string `xml:"uint16"` + Uint32 string `xml:"uint32"` + ByteArray16 string `xml:"byteArray16"` + } `xml:"valueLow"` + ValueHigh struct { + Text string `xml:",chardata"` + Type string `xml:"type"` + Uint16 string `xml:"uint16"` + Uint32 string `xml:"uint32"` + ByteArray16 string `xml:"byteArray16"` + } `xml:"valueHigh"` + } `xml:"rangeValue"` + Uint8 string `xml:"uint8"` + ByteBlob struct { + Text string `xml:",chardata"` + Data string `xml:"data"` + AsString string `xml:"asString"` + } `xml:"byteBlob"` + Sd string `xml:"sd"` + Sid string `xml:"sid"` + Uint64 string `xml:"uint64"` + } `xml:"conditionValue"` + } `xml:"item"` + } `xml:"filterCondition"` + Action struct { + Text string `xml:",chardata"` + Type string `xml:"type"` + FilterType string `xml:"filterType"` + } `xml:"action"` + RawContext string `xml:"rawContext"` + Reserved string `xml:"reserved"` + FilterID string `xml:"filterId"` + EffectiveWeight struct { + Text string `xml:",chardata"` + Type string `xml:"type"` + Uint64 string `xml:"uint64"` + } `xml:"effectiveWeight"` + ProviderContextKey string `xml:"providerContextKey"` + } `xml:"item"` + } `xml:"filters"` + } `xml:"item"` + } `xml:"layers"` +} + +func parseWFPState(data []byte) (*wfpState, error) { + w := &wfpState{} + err := xml.Unmarshal(data, w) + if err != nil { + return nil, err + } + return w, nil +} + +func (w *wfpState) simplified() *SimplifiedWFPState { + sw := &SimplifiedWFPState{ + Providers: make([]*WFPProvider, 0, len(w.Providers.Item)), + SubLayers: make([]*WFPSubLayer, 0, len(w.SubLayers.Item)), + Callouts: make([]*WFPCallout, 0, len(w.Layers.Item)), + Filters: make([]*WFPFilter, 0, len(w.Layers.Item)), + } + + // Collect data. + for _, provider := range w.Providers.Item { + if isIgnoredProvider(provider.DisplayData.Name, provider.ProviderKey) { + continue + } + + sw.Providers = append(sw.Providers, &WFPProvider{ + Name: defaultTo(provider.DisplayData.Name, "[no name]"), + Description: defaultTo(provider.DisplayData.Description, "[no description]"), + ProviderKey: defaultTo(provider.ProviderKey, "[no provider key]"), + }) + } + for _, subLayer := range w.SubLayers.Item { + if isIgnoredProvider(subLayer.DisplayData.Name, "") { + continue + } + + sw.SubLayers = append(sw.SubLayers, &WFPSubLayer{ + Name: defaultTo(subLayer.DisplayData.Name, "[no name]"), + Description: defaultTo(subLayer.DisplayData.Description, "[no description]"), + SubLayerKey: defaultTo(subLayer.SubLayerKey, "[no sublayer key]"), + }) + } + for _, layer := range w.Layers.Item { + for _, callout := range layer.Callouts.Item { + if isIgnoredProvider(callout.DisplayData.Name, callout.ProviderKey) { + continue + } + + sw.Callouts = append(sw.Callouts, &WFPCallout{ + Name: defaultTo(callout.DisplayData.Name, "[no name]"), + Description: defaultTo(callout.DisplayData.Description, "[no description]"), + CalloutKey: defaultTo(callout.CalloutKey, "[no callout key]"), + ProviderKey: defaultTo(callout.ProviderKey, "[no provider key]"), + ApplicableLayer: defaultTo(callout.ApplicableLayer, "[no applicable layer]"), + }) + } + for _, filter := range layer.Filters.Item { + if isIgnoredProvider(filter.DisplayData.Name, filter.ProviderKey) { + continue + } + + sw.Filters = append(sw.Filters, &WFPFilter{ + Name: defaultTo(filter.DisplayData.Name, "[no name]"), + Description: defaultTo(filter.DisplayData.Description, "[no description]"), + FilterKey: defaultTo(filter.FilterKey, "[no filter key]"), + ProviderKey: defaultTo(filter.ProviderKey, "[no provider key]"), + LayerKey: defaultTo(filter.LayerKey, "[no layer key]"), + SubLayerKey: defaultTo(filter.SubLayerKey, "[no sublayer key]"), + }) + } + } + + return sw +} + +func isIgnoredProvider(name, key string) bool { + // Check provider key. + if key != "" { + matched := true + switch key { + case "{1bebc969-61a5-4732-a177-847a0817862a}": // Microsoft Windows Defender Firewall IPsec Provider. + case "{4b153735-1049-4480-aab4-d1b9bdc03710}": // Microsoft Windows Defender Firewall Provider. + case "{893a4f22-9bba-49b7-8c66-3d40929c8fd5}": // Microsoft Windows Teredo firewall provider. + case "{8e44982a-f477-11df-85ce-78e7d1810190}": // Windows Network Data Usage (NDU) Provider. + case "{9c2532b4-0314-434f-8274-0cbaebdbda56}": // Microsoft Windows edge traversal socket option authorization provider. + case "{aa6a7d87-7f8f-4d2a-be53-fda555cd5fe3}": // Microsoft Windows Defender Firewall IPsec Provider. + case "{c698301d-9129-450c-937c-f4b834bfb374}": // Microsoft Windows edge traversal socket option authorization provider. + case "{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}": // Microsoft Windows Defender Firewall Provider. + case "FWPM_PROVIDER_IKEEXT": // Microsoft Windows WFP Built-in IKEEXT provider used to identify filters added by IKE/AuthIP. + case "FWPM_PROVIDER_IPSEC_DOSP_CONFIG": // Microsoft Windows WFP Built-in IPsec DoS Protection configuration provider used to identify filters added by IPsec Denial of Service Protection. + case "FWPM_PROVIDER_MPSSVC_APP_ISOLATION": // Microsoft Windows WFP Built-in MPSSVC App Isolation provider. + case "FWPM_PROVIDER_MPSSVC_EDP": // Microsoft Windows WFP Built-in MPSSVC Enterprise Data Protection provider. + case "FWPM_PROVIDER_MPSSVC_TENANT_RESTRICTIONS": // Microsoft Windows WFP Built-in MPSSVC Tenant Restrictions provider. + case "FWPM_PROVIDER_MPSSVC_WF": // Microsoft Windows WFP Built-in MPSSVC Windows Firewall provider. + case "FWPM_PROVIDER_MPSSVC_WSH": // Microsoft Windows WFP Built-in MPSSVC Windows Service Hardening and Quarantine provider. + case "FWPM_PROVIDER_TCP_CHIMNEY_OFFLOAD": // Microsoft Windows WFP Built-in TCP Chimney Offload provider used to identify filters added by TCP Chimney Offload. + case "FWPM_PROVIDER_TCP_TEMPLATES": // Microsoft Windows WFP Built-in TCP Templates provider used to identify filters added by TCP Template based configuration. + default: + matched = false + } + if matched { + return true + } + } + + // Some entries don't have a provider key (set). + // These are pretty generic, but the output strings are localized. + if name != "" { + switch { + case strings.Contains(name, "Microsoft Corporation"): + return true + case strings.Contains(name, "windefend"): + return true + case strings.Contains(name, "WFP"): + return true + case strings.Contains(name, "RPC"): + return true + case strings.Contains(name, "NDU"): + return true + } + } + + return false +} + +func defaultTo(a, b string) string { + if a != "" { + return a + } + return b +} diff --git a/compat/wfpstate_test.go b/compat/wfpstate_test.go new file mode 100644 index 00000000..cda32b68 --- /dev/null +++ b/compat/wfpstate_test.go @@ -0,0 +1,56270 @@ +package compat + +import ( + "fmt" + "strings" + "testing" +) + +func TestWFPState(t *testing.T) { + t.Parallel() + + w, err := parseWFPState(wfpTestData) + if err != nil { + t.Fatal(err) + } + + output := w.simplified().AsTable() + fmt.Println(output) + + outputLines := strings.Count(output, "\n") + if outputLines != 10 { + t.Errorf("Expected 10 output lines, not %d", outputLines) + } +} + +var wfpTestData = []byte(` + + + + + FWPM_LAYER_INBOUND_IPPACKET_V4 + + Inbound IP Packet v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 0 + + + + {05c55149-4732-4857-8d10-f178f3a06f8c} + + PortmasterInboundV4Callout + This callout is used by the Portmaster to intercept inbound IPv4 traffic. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_INBOUND_IPPACKET_V4 + 290 + + + + + {fb2f56c5-3883-475a-8c78-047d1f93b5a9} + + PortmasterInboundV4Filter + This filter is used by the Portmaster to intercept inbound IPv4 traffic. + + + FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT + + + + FWPM_LAYER_INBOUND_IPPACKET_V4 + {a87fb472-fc68-4805-8559-c6ae774773e0} + + FWP_UINT8 + 15 + + + + FWP_ACTION_CALLOUT_TERMINATING + {05c55149-4732-4857-8d10-f178f3a06f8c} + + 0 + + 68136 + + FWP_UINT64 + 17293822569102704640 + + + + + + + FWPM_LAYER_INBOUND_IPPACKET_V4_DISCARD + + Inbound IP Packet v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 1 + + + + + + + FWPM_LAYER_INBOUND_IPPACKET_V6 + + Inbound IP Packet v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 2 + + + + {ceff1df7-2baa-44c5-a6e5-73a95849bcff} + + PortmasterInboundV6Callout + This callout is used by the Portmaster to intercept inbound IPv6 traffic. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_INBOUND_IPPACKET_V6 + 292 + + + + + {778afeeb-9680-4a59-82d5-abc33b3fb183} + + PortmasterInboundV6Filter + This filter is used by the Portmaster to intercept inbound IPv6 traffic. + + + FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT + + + + FWPM_LAYER_INBOUND_IPPACKET_V6 + {a87fb472-fc68-4805-8559-c6ae774773e0} + + FWP_UINT8 + 15 + + + + FWP_ACTION_CALLOUT_TERMINATING + {ceff1df7-2baa-44c5-a6e5-73a95849bcff} + + 0 + + 68138 + + FWP_UINT64 + 17293822569102704640 + + + + + + + FWPM_LAYER_INBOUND_IPPACKET_V6_DISCARD + + Inbound IP Packet v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 3 + + + + + + + FWPM_LAYER_OUTBOUND_IPPACKET_V4 + + Outbound IP Packet v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 4 + + + + {41162b9e-8473-4b88-a5eb-04cf1d276b06} + + PortmasterOutboundV4Callout + This callout is used by the Portmaster to intercept outbound IPv4 traffic. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_OUTBOUND_IPPACKET_V4 + 291 + + + + + {609b24b3-7b9a-48e1-8994-c72a42bbd319} + + PortmasterOutboundV4Filter + This filter is used by the Portmaster to intercept outbound IPv4 traffic. + + + FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT + + + + FWPM_LAYER_OUTBOUND_IPPACKET_V4 + {a87fb472-fc68-4805-8559-c6ae774773e0} + + FWP_UINT8 + 15 + + + + FWP_ACTION_CALLOUT_TERMINATING + {41162b9e-8473-4b88-a5eb-04cf1d276b06} + + 0 + + 68137 + + FWP_UINT64 + 17293822569102704640 + + + + + + + FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD + + Outbound IP Packet v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 5 + + + + + + + FWPM_LAYER_OUTBOUND_IPPACKET_V6 + + Outbound IP Packet v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 6 + + + + {32bad112-6af4-4109-809b-c07570ba01b4} + + PortmasterOutboundV6Callout + This callout is used by the Portmaster to intercept outbound IPv6 traffic. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_OUTBOUND_IPPACKET_V6 + 293 + + + + + {23ae199a-7949-4059-b799-67e7a1a57fcb} + + PortmasterOutboundV6Filter + This filter is used by the Portmaster to intercept outbound IPv6 traffic. + + + FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT + + + + FWPM_LAYER_OUTBOUND_IPPACKET_V6 + {a87fb472-fc68-4805-8559-c6ae774773e0} + + FWP_UINT8 + 15 + + + + FWP_ACTION_CALLOUT_TERMINATING + {32bad112-6af4-4109-809b-c07570ba01b4} + + 0 + + 68139 + + FWP_UINT64 + 17293822569102704640 + + + + + + + FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD + + Outbound IP Packet v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 7 + + + + + + + FWPM_LAYER_IPFORWARD_V4 + + IP Forward v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_SOURCE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_FORWARD_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_SOURCE_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DESTINATION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 8 + + + + FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4 + + WFP Built-in IPsec Forward Inbound Tunnel v4 Layer Callout + Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000020 + + + + FWPM_LAYER_IPFORWARD_V4 + 9 + + + FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4 + + WFP Built-in IPsec Forward Outbound Tunnel v4 Layer Callout + Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000020 + + + + FWPM_LAYER_IPFORWARD_V4 + 11 + + + + + {935b7f48-0ede-44dd-9bc2-e00bb635cda3} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_IPFORWARD_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 786432 + + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66238 + + FWP_UINT64 + 4 + + + + + + + FWPM_LAYER_IPFORWARD_V4_DISCARD + + IP Forward v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_SOURCE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_FORWARD_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_SOURCE_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DESTINATION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 9 + + + + + + + FWPM_LAYER_IPFORWARD_V6 + + IP Forward v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_SOURCE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_FORWARD_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_SOURCE_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DESTINATION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 10 + + + + FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6 + + WFP Built-in IPsec Forward Inbound Tunnel v6 Layer Callout + Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000020 + + + + FWPM_LAYER_IPFORWARD_V6 + 10 + + + FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6 + + WFP Built-in IPsec Forward Outbound Tunnel v6 Layer Callout + Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000020 + + + + FWPM_LAYER_IPFORWARD_V6 + 12 + + + + + {941dad9d-7b1a-4354-997b-00cf1aa9b35c} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_IPFORWARD_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 786432 + + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66239 + + FWP_UINT64 + 4 + + + + + + + FWPM_LAYER_IPFORWARD_V6_DISCARD + + IP Forward v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_SOURCE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_FORWARD_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_SOURCE_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DESTINATION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 11 + + + + + + + FWPM_LAYER_INBOUND_TRANSPORT_V4 + + Inbound Transport v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 12 + + + + FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4 + + WFP Built-in IPsec Inbound Transport v4 Layer Callout + Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000260 + + + + FWPM_LAYER_INBOUND_TRANSPORT_V4 + 1 + + + FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4 + + WFP Built-in IPsec Inbound Tunnel v4 Layer Callout + Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000020 + + + + FWPM_LAYER_INBOUND_TRANSPORT_V4 + 5 + + + + + + + FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD + + Inbound Transport v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 13 + + + + FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP + + WFP Built-in Silent Drop Transport v4 Discard Layer Callout + Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint. + + + FWP_CALLOUT_FLAG_ALLOW_OFFLOAD + FWPM_CALLOUT_FLAG_REGISTERED + 00000240 + + + + FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD + 17 + + + + + {03c67493-1802-44a0-ad5f-3ae741e25c15} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68060 + + FWP_UINT64 + 18446744073709551615 + + + + {29ccd323-aecf-4990-b96a-c5384222b0c9} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68062 + + FWP_UINT64 + 18446744073709551615 + + + + {92ff43ac-9df0-49e9-b3b3-d6f8421edcca} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68064 + + FWP_UINT64 + 18446744073709551615 + + + + {b2a53430-2096-4b30-ae54-260f96a82028} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 12 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 3 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68066 + + FWP_UINT64 + 13835058055349272576 + + + + + + + FWPM_LAYER_INBOUND_TRANSPORT_V6 + + Inbound Transport v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 14 + + + + FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6 + + WFP Built-in IPsec Inbound Transport v6 Layer Callout + Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000260 + + + + FWPM_LAYER_INBOUND_TRANSPORT_V6 + 2 + + + FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6 + + WFP Built-in IPsec Inbound Tunnel v6 Layer Callout + Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000020 + + + + FWPM_LAYER_INBOUND_TRANSPORT_V6 + 6 + + + + + + + FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD + + Inbound Transport v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 15 + + + + FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP + + WFP Built-in Silent Drop Transport v6 Discard Layer Callout + Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint. + + + FWP_CALLOUT_FLAG_ALLOW_OFFLOAD + FWPM_CALLOUT_FLAG_REGISTERED + 00000240 + + + + FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD + 18 + + + + + {57175e0d-0212-4ddd-b229-559795b43af7} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68061 + + FWP_UINT64 + 18446744073709551615 + + + + {d979d760-083e-489d-9360-1f377b606ef1} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68063 + + FWP_UINT64 + 18446744073709551615 + + + + {22b3ef06-6428-47ac-868f-b4a968fe995c} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68065 + + FWP_UINT64 + 18446744073709551615 + + + + {f3ecd3f5-9498-4dce-a76d-da32be01382f} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 12 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 3 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68067 + + FWP_UINT64 + 13835058055298940928 + + + + + + + FWPM_LAYER_OUTBOUND_TRANSPORT_V4 + + Outbound Transport v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 16 + + + + FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4 + + WFP Built-in IPsec Outbound Transport v4 Layer Callout + Indicates to IPsec the outbound traffic that must be secured over transport mode security associations. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000260 + + + + FWPM_LAYER_OUTBOUND_TRANSPORT_V4 + 3 + + + FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4 + + WFP Built-in IPsec Outbound Tunnel v4 Layer Callout + Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000020 + + + + FWPM_LAYER_OUTBOUND_TRANSPORT_V4 + 7 + + + + + + + FWPM_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD + + Outbound Transport v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 17 + + + + + + + FWPM_LAYER_OUTBOUND_TRANSPORT_V6 + + Outbound Transport v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 18 + + + + FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6 + + WFP Built-in IPsec Outbound Transport v6 Layer Callout + Indicates to IPsec the outbound traffic that must be secured over transport mode security associations. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000260 + + + + FWPM_LAYER_OUTBOUND_TRANSPORT_V6 + 4 + + + FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6 + + WFP Built-in IPsec Outbound Tunnel v6 Layer Callout + Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000020 + + + + FWPM_LAYER_OUTBOUND_TRANSPORT_V6 + 8 + + + + + + + FWPM_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD + + Outbound Transport v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 19 + + + + + + + FWPM_LAYER_STREAM_V4 + + Stream v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + FWPM_LAYER_FLAG_BUFFERED + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 20 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0414} + + Windows Firewall: callout + Connection-oriented protocol packet inspection. + + + FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW + FWPM_CALLOUT_FLAG_REGISTERED + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_STREAM_V4 + 288 + + + {d67b238d-d80c-4ba7-96df-4a0c83464fa7} + + windefend_stream_v4 + windefend + + + FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_STREAM_V4 + 294 + + + + + {821997be-23bb-4240-87a2-2615caec3d1f} + + Deep Protocol Inspection Filter + This filter implements deep inspection for FTP protocols. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_STREAM_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0414} + + 0 + + 68050 + + FWP_UINT64 + 18446744073709551615 + + + + {42e67750-e0ae-4ec7-aa42-97c6605b1c96} + + windefend_stream_v4 + windefend + + + FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED + + + + FWPM_LAYER_STREAM_V4 + {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_TERMINATING + {d67b238d-d80c-4ba7-96df-4a0c83464fa7} + + 0 + + 68276 + + FWP_UINT64 + 0 + + + + + + + FWPM_LAYER_STREAM_V4_DISCARD + + Stream v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + FWPM_LAYER_FLAG_BUFFERED + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 21 + + + + + + + FWPM_LAYER_STREAM_V6 + + Stream v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + FWPM_LAYER_FLAG_BUFFERED + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 22 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0416} + + Windows Firewall: callout + Connection-oriented protocol packet inspection. + + + FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW + FWPM_CALLOUT_FLAG_REGISTERED + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_STREAM_V6 + 289 + + + {36d4cf95-fd3a-4bb8-90a9-ffdb3749237f} + + windefend_stream_v6 + windefend + + + FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_STREAM_V6 + 295 + + + + + {ecdc6e7a-8981-4a13-92d7-fb12f8d0ea9f} + + Deep Protocol Inspection Filter + This filter implements deep inspection for FTP protocols. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_STREAM_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0416} + + 0 + + 68051 + + FWP_UINT64 + 18446744073709551615 + + + + {094b9bb6-e451-4069-ac23-5fe695ec9662} + + windefend_stream_v6 + windefend + + + FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED + + + + FWPM_LAYER_STREAM_V6 + {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_TERMINATING + {36d4cf95-fd3a-4bb8-90a9-ffdb3749237f} + + 0 + + 68277 + + FWP_UINT64 + 0 + + + + + + + FWPM_LAYER_STREAM_V6_DISCARD + + Stream v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + FWPM_LAYER_FLAG_BUFFERED + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 23 + + + + + + + FWPM_LAYER_DATAGRAM_DATA_V4 + + Datagram Data v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 24 + + + + {b2d11c73-b4ef-47d1-b665-58e6ba9fe200} + + windefend_datagram_v4 + windefend + + + FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_DATAGRAM_DATA_V4 + 300 + + + + + {67dc47f0-7a3b-4705-a4e7-bb8756a3e69f} + + windefend_datagram_v4 + windefend + + + FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED + + + + FWPM_LAYER_DATAGRAM_DATA_V4 + {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_TERMINATING + {b2d11c73-b4ef-47d1-b665-58e6ba9fe200} + + 0 + + 68282 + + FWP_UINT64 + 0 + + + + + + + FWPM_LAYER_DATAGRAM_DATA_V4_DISCARD + + Datagram Data v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 25 + + + + + + + FWPM_LAYER_DATAGRAM_DATA_V6 + + Datagram Data v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 26 + + + + {80cece9d-0b53-4672-ac43-4524416c0353} + + windefend_datagram_v6 + windefend + + + FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_DATAGRAM_DATA_V6 + 301 + + + + + {f875d7d9-b132-436d-a729-479ef4e4ef08} + + windefend_datagram_v6 + windefend + + + FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED + + + + FWPM_LAYER_DATAGRAM_DATA_V6 + {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_TERMINATING + {80cece9d-0b53-4672-ac43-4524416c0353} + + 0 + + 68283 + + FWP_UINT64 + 0 + + + + + + + FWPM_LAYER_DATAGRAM_DATA_V6_DISCARD + + Datagram Data v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 27 + + + + + + + FWPM_LAYER_INBOUND_ICMP_ERROR_V4 + + Inbound ICMP Error v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_EMBEDDED_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_EMBEDDED_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_EMBEDDED_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 28 + + + + + {0c41d586-9c19-4e01-9d66-b5b98a97576e} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66212 + + FWP_UINT64 + 18446744073709551615 + + + + {4d9581d2-aef8-4993-84cd-b986ced80d42} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66216 + + FWP_UINT64 + 18446744073709551615 + + + + {074f7f68-ee10-428a-89d1-ba78f6c327ca} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66224 + + FWP_UINT64 + 0 + + + + {91ffecf0-0a9e-4572-95f1-a7111af86967} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66228 + + FWP_UINT64 + 0 + + + + {08f09e8d-2754-4cc2-b595-7260f3a8df9d} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67629 + + FWP_UINT64 + 9223372036854775812 + + + + {b8b57642-80b0-49d5-b5d6-34834967743d} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWP_ACTION_BLOCK + + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67637 + + FWP_UINT64 + 3458764513820540928 + + + + + + + FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD + + Inbound ICMP Error v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_EMBEDDED_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_EMBEDDED_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_EMBEDDED_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 29 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e011d} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD + 276 + + + + + + + FWPM_LAYER_INBOUND_ICMP_ERROR_V6 + + Inbound ICMP Error v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_EMBEDDED_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_EMBEDDED_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_EMBEDDED_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 30 + + + + + {12c38916-82ac-4737-8f38-b6957ffebad6} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66213 + + FWP_UINT64 + 18446744073709551615 + + + + {be7cbdf4-b192-4aa5-94f8-1fb5c5ee07bc} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66217 + + FWP_UINT64 + 18446744073709551615 + + + + {c016105c-eb34-4519-a5fd-5f4e4ad4d18e} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66225 + + FWP_UINT64 + 0 + + + + {64e55933-15a5-495d-a928-ccca43d44875} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66229 + + FWP_UINT64 + 0 + + + + {cc44ca04-e1d0-42ef-8fd1-ffe89f6ed166} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67633 + + FWP_UINT64 + 9223372036854775812 + + + + {49ec4b6a-348d-41ae-8777-f7c59ec17f26} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_INBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWP_ACTION_BLOCK + + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67641 + + FWP_UINT64 + 3458764513820540928 + + + + + + + FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD + + Inbound ICMP Error v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_EMBEDDED_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_EMBEDDED_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_EMBEDDED_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 31 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e011f} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD + 277 + + + + + + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + + Outbound ICMP Error v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 32 + + + + + {07a24961-a760-4e80-b263-6d275e1b09cb} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66220 + + FWP_UINT64 + 18446744073709551615 + + + + {b308b233-cd6c-401d-9f09-3a80217f778e} + + Default Outbound + This is the default outbound filter which blocks or permits traffic based on user configured default settings + + + FWPM_PROVIDER_MPSSVC_WF + + 9500000000000000 + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67643 + + FWP_UINT64 + 9223372036854775812 + + + + {bfe4943b-6e61-4ae6-a187-d62d68351430} + + Default Outbound + This is the default outbound filter which blocks or permits traffic based on user configured default settings + + + FWPM_PROVIDER_MPSSVC_WF + + 9500000000000000 + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWP_ACTION_PERMIT + + + 0 + + 67647 + + FWP_UINT64 + 3458764513820540928 + + + + {c313817b-32a7-4160-95b2-4673a26e0cab} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 0 + + + FWP_UINT16 + 3 + + + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68068 + + FWP_UINT64 + 9223372586040164364 + + + + {3228da2c-00c2-4f05-8f8c-682315fe7530} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5 + + + FWP_UINT16 + 12 + + + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68069 + + FWP_UINT64 + 9223372585771728908 + + + + {a2fd53b1-e627-4962-aede-c508dac25267} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 14 + + + FWP_UINT16 + 255 + + + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68070 + + FWP_UINT64 + 9223372584463106060 + + + + {2260bd8b-6481-4879-93f1-9435d24d2528} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 0 + + + FWP_UINT16 + 3 + + + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68073 + + FWP_UINT64 + 9223372586040164364 + + + + {7224a028-a279-4c7b-b136-40f7516b88cc} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5 + + + FWP_UINT16 + 12 + + + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68074 + + FWP_UINT64 + 9223372585771728908 + + + + {3339fd71-a0e9-4714-87f6-e9ec698fab6b} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 14 + + + FWP_UINT16 + 255 + + + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68075 + + FWP_UINT64 + 9223372584463106060 + + + + {9eaf6f7b-ed11-48fb-b3c5-592921db1103} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 0 + + + FWP_UINT16 + 3 + + + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68078 + + FWP_UINT64 + 18446744073709551615 + + + + {ef4ccd1e-f08d-4199-85e1-3ef56963f09e} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744069414584322 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5 + + + FWP_UINT16 + 12 + + + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68079 + + FWP_UINT64 + 18446744069414584322 + + + + {0365edae-cbe6-4657-8943-2d16058c98c2} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744069414584322 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 14 + + + FWP_UINT16 + 255 + + + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68080 + + FWP_UINT64 + 18446744069414584322 + + + + {c2b8dc84-bfca-4c6d-ba88-5325839ea39f} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 0 + + + FWP_UINT16 + 3 + + + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68083 + + FWP_UINT64 + 18446744073709551615 + + + + {d5afb3be-9eb2-40c3-8fa9-3e8ee38948c5} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744069414584322 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5 + + + FWP_UINT16 + 12 + + + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68084 + + FWP_UINT64 + 18446744069414584322 + + + + {4c7ffc63-9f38-44b9-8624-b85abd89b7a6} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744069414584322 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 14 + + + FWP_UINT16 + 255 + + + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68085 + + FWP_UINT64 + 18446744069414584322 + + + + + + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD + + Outbound ICMP Error v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 33 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0121} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD + 272 + + + + + + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + + Outbound ICMP Error v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 34 + + + + + {5b0cb2e2-ab87-4974-9f1c-2f22a654eeb9} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66221 + + FWP_UINT64 + 18446744073709551615 + + + + {da00b2e8-656f-40cc-9a37-444f32c5e58a} + + Default Outbound + This is the default outbound filter which blocks or permits traffic based on user configured default settings + + + FWPM_PROVIDER_MPSSVC_WF + + 9500000000000000 + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67645 + + FWP_UINT64 + 9223372036854775812 + + + + {70fb0d21-2477-44bc-967b-494c061e96eb} + + Default Outbound + This is the default outbound filter which blocks or permits traffic based on user configured default settings + + + FWPM_PROVIDER_MPSSVC_WF + + 9500000000000000 + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWP_ACTION_PERMIT + + + 0 + + 67649 + + FWP_UINT64 + 3458764513820540928 + + + + {b9b272fb-b866-4e48-9385-c1bee91957da} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68071 + + FWP_UINT64 + 9223372070677643276 + + + + {331a54f2-38e6-43de-943b-9742b565db8c} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 0 + + + FWP_UINT16 + 2 + + + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68072 + + FWP_UINT64 + 9223372071155793932 + + + + {722d30ec-406b-423a-b027-d7dd8a306836} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68076 + + FWP_UINT64 + 9223372070677643276 + + + + {c6a5f146-bbad-4cad-8de4-0c3a4d349f77} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 0 + + + FWP_UINT16 + 2 + + + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68077 + + FWP_UINT64 + 9223372071155793932 + + + + {a6c63b22-fa8c-4afc-88ab-3f0a8faf213a} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744069414584322 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 1 + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68081 + + FWP_UINT64 + 18446744069414584322 + + + + {45648f6f-4589-44e3-8959-75b391aa0038} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744069414584322 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 0 + + + FWP_UINT16 + 2 + + + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68082 + + FWP_UINT64 + 18446744069414584322 + + + + {dd1e0820-fc15-4492-9403-ef2c61e329bb} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744069414584322 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 1 + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68086 + + FWP_UINT64 + 18446744069414584322 + + + + {4d5e5002-239a-4d48-a681-d7c3c49517d1} + + Port Scanning Prevention Filter + This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744069414584322 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 0 + + + FWP_UINT16 + 2 + + + + + + + FWP_ACTION_BLOCK + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68087 + + FWP_UINT64 + 18446744069414584322 + + + + + + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD + + Outbound ICMP Error v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 35 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0123} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD + 273 + + + + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + + ALE Resource Assignment v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_ALE_PROMISCUOUS_MODE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 36 + + + + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 + + WFP Built-in Edge Traversal ALE Resource Assignment v4 Layer Callout + Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000014 + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + 27 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0024} + + Windows Firewall: callout + Notifies the user. + + + FWPM_CALLOUT_FLAG_REGISTERED + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + 268 + + + {58d7275b-2fd2-4b6c-b93a-30037e577d7e} + + windefend_resource_assignment_v4 + windefend + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + 296 + + + + + {fec997ae-7462-4ec1-b9af-99c4751fd489} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 9 + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0024} + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67628 + + FWP_UINT64 + 9223442268161048576 + + + + {e71db8d0-e58f-45fa-8d34-6e66c5ec8cc1} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 9 + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0024} + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67636 + + FWP_UINT64 + 3458834745126813696 + + + + {cd49bc81-9428-4bfe-9fad-d20504a480a2} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67663 + + FWP_UINT64 + 11529003905476198400 + + + + {d0db3fd9-fa82-4abf-aa82-87a9645636de} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 + + 0 + + 67664 + + FWP_UINT64 + 11529003905476198400 + + + + {69f35305-c344-4543-891f-28168fbd3f31} + + Core Networking - Dynamic Host Configuration Protocol (DHCP-In) + Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration. + + + FWPM_PROVIDER_MPSSVC_WF + + 9f00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 68 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67677 + + FWP_UINT64 + 11529003905476198400 + + + + {77c9fe79-5402-402e-8226-c8b570fd6388} + + Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In) + Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration. + + + FWPM_PROVIDER_MPSSVC_WF + + a000000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 546 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67681 + + FWP_UINT64 + 11529003905476198400 + + + + {8235388e-e851-4838-a33f-fb98db5a3e5a} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 + + 0 + + 67773 + + FWP_UINT64 + 10376363875846062080 + + + + {eeb93afc-0f8e-4b50-b378-4517aeacf07a} + + XING + XING + + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 + + 0 + + 67785 + + FWP_UINT64 + 10376363875846062080 + + + + {8bbc020b-4c16-4c42-9147-0c7f61f2a27b} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 + + 0 + + 67797 + + FWP_UINT64 + 10376363875846062080 + + + + {a2b54f0b-3d87-462c-bfe7-5aff5618a7b3} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 + + 0 + + 67809 + + FWP_UINT64 + 10376363875846062080 + + + + {8db0f20c-e041-4c94-93c3-2acdf0380dc4} + + Microsoft Teams + Microsoft Teams + + + FWPM_PROVIDER_MPSSVC_WF + + b800000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 + \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67824 + + FWP_UINT64 + 10376363841486323712 + + + + {2d6dcea9-f654-406c-bad0-c12935683e86} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 + + 0 + + 67829 + + FWP_UINT64 + 10376363875846062080 + + + + {c5f25e64-ac27-4d08-ac2e-fc083d790752} + + Cortana + Cortana + + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 + + 0 + + 67841 + + FWP_UINT64 + 10376363875846062080 + + + + {68ce3ad4-d6a7-4f3b-94bf-9d7ddbbfd856} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_PROVIDER_MPSSVC_WF + + bb00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67852 + + FWP_UINT64 + 11529003871116460032 + + + + {1e498170-bf78-40d0-8534-89420cdeb047} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_PROVIDER_MPSSVC_WF + + bd00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67868 + + FWP_UINT64 + 11529003871116460032 + + + + {965c8ce5-bb4c-4ece-9b94-fbab1f02bd61} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_PROVIDER_MPSSVC_WF + + be00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67872 + + FWP_UINT64 + 11529003871116460032 + + + + {1663d17f-13ac-4339-a87d-0b8177c6a161} + + Microsoft Media Foundation Network Source IN [UDP 5004-5009] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP + + + FWPM_PROVIDER_MPSSVC_WF + + 1f01000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5000 + + + FWP_UINT16 + 5020 + + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68214 + + FWP_UINT64 + 11212626031653421056 + + + + {2c0936a0-ca0e-45fd-8ca2-f7a00123be5c} + + WFD ASP Coordination Protocol (UDP-In) + Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] + + + FWPM_PROVIDER_MPSSVC_WF + + 2201000000000000 + "....... + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68234 + + FWP_UINT64 + 11529003905476198400 + + + + {d89bb141-b39a-4088-96b4-558cb5f9f818} + + mDNS (UDP-In) + Inbound rule for mDNS traffic [UDP] + + + FWPM_PROVIDER_MPSSVC_WF + + 2601000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68246 + + FWP_UINT64 + 11529003905476198400 + + + + {26501d40-8df2-4445-9f4b-a8a19f2afeb8} + + windefend_resource_assignment_v4 + windefend + + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_INSPECTION + {58d7275b-2fd2-4b6c-b93a-30037e577d7e} + + 0 + + 68278 + + FWP_UINT64 + 0 + + + + {ba25c88a-4995-4529-bbd9-095462c2ab55} + + Microsoft Store + Microsoft Store + + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4 + + 0 + + 68285 + + FWP_UINT64 + 10376363875846062080 + + + + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD + + ALE Resource Assignment v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_ALE_PROMISCUOUS_MODE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 37 + + + + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + + ALE Resource Assignment v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_ALE_PROMISCUOUS_MODE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 38 + + + + FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 + + WFP Built-in Edge Traversal ALE Resource Assignment v6 Layer Callout + Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000014 + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + 28 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0026} + + Windows Firewall: callout + Notifies the user. + + + FWPM_CALLOUT_FLAG_REGISTERED + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + 269 + + + {ced78e5f-1dd1-485a-9d35-7e44cc9d784d} + + windefend_resource_assignment_v6 + windefend + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + 297 + + + + + {233dc13e-f91d-4576-8c0a-c258350a7620} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 9 + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0026} + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67632 + + FWP_UINT64 + 9223511674839891968 + + + + {d6ac0d0d-5259-4e91-b3da-6dd38df859a0} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 9 + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0026} + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67640 + + FWP_UINT64 + 3458904151805657088 + + + + {cb5e3e43-13f9-4f37-a3d8-c0a6ee6a157b} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67668 + + FWP_UINT64 + 11528792558725496832 + + + + {9c5b7174-b5ba-4ebe-87f3-49d42065c090} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 + + 0 + + 67669 + + FWP_UINT64 + 11528792558725496832 + + + + {ccb39a7c-ffcc-41e1-b3d5-5508c22d7ae8} + + Core Networking - Dynamic Host Configuration Protocol (DHCP-In) + Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration. + + + FWPM_PROVIDER_MPSSVC_WF + + 9f00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 68 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67679 + + FWP_UINT64 + 11528792558725496832 + + + + {6bfcb550-a334-493c-bfa9-0fd5778762d3} + + Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In) + Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration. + + + FWPM_PROVIDER_MPSSVC_WF + + a000000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 546 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67683 + + FWP_UINT64 + 11528792558725496832 + + + + {f1d77b93-024f-4ced-96fa-583e3777c094} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 + + 0 + + 67778 + + FWP_UINT64 + 10376434004072071168 + + + + {4ad1f317-75d8-4c41-b699-586bdc947b61} + + XING + XING + + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 + + 0 + + 67790 + + FWP_UINT64 + 10376434004072071168 + + + + {5856855b-110b-411a-9edb-c83af7970e2a} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 + + 0 + + 67802 + + FWP_UINT64 + 10376434004072071168 + + + + {449e8fbb-acaf-4cfe-a93c-01c8b5a04e2f} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 + + 0 + + 67814 + + FWP_UINT64 + 10376434004072071168 + + + + {b0f609a0-8de9-4641-93e8-322951f06806} + + Microsoft Teams + Microsoft Teams + + + FWPM_PROVIDER_MPSSVC_WF + + b800000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 + \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67826 + + FWP_UINT64 + 10376433729194164224 + + + + {efbc5936-c530-4944-a424-354d0f15516f} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 + + 0 + + 67834 + + FWP_UINT64 + 10376434004072071168 + + + + {65a89691-b6bc-453a-ba4f-60b8f2f5afce} + + Cortana + Cortana + + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 + + 0 + + 67846 + + FWP_UINT64 + 10376434004072071168 + + + + {2429f54d-a7e7-428b-8b99-db319e9fbeec} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_PROVIDER_MPSSVC_WF + + bb00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67854 + + FWP_UINT64 + 11528792283847589888 + + + + {6f59015a-2f44-4527-95c2-ef891e2ee42e} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_PROVIDER_MPSSVC_WF + + bd00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67870 + + FWP_UINT64 + 11528792283847589888 + + + + {4373e6d8-0cba-416a-8957-5346f3a3810f} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_PROVIDER_MPSSVC_WF + + be00000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67874 + + FWP_UINT64 + 11528792283847589888 + + + + {e4be4ec1-3874-4bb7-91f4-ef1252a96e4a} + + Microsoft Media Foundation Network Source IN [UDP 5004-5009] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP + + + FWPM_PROVIDER_MPSSVC_WF + + 1f01000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5000 + + + FWP_UINT16 + 5020 + + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68217 + + FWP_UINT64 + 11212414684902719488 + + + + {95d5968b-f1ce-43f6-8edd-f24b0776f8b0} + + WFD ASP Coordination Protocol (UDP-In) + Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] + + + FWPM_PROVIDER_MPSSVC_WF + + 2201000000000000 + "....... + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68237 + + FWP_UINT64 + 11528792558725496832 + + + + {c98871d1-4f49-4853-9a6e-35cae1fa3f17} + + mDNS (UDP-In) + Inbound rule for mDNS traffic [UDP] + + + FWPM_PROVIDER_MPSSVC_WF + + 2601000000000000 + ........ + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68249 + + FWP_UINT64 + 11528792558725496832 + + + + {8c0045d4-35b0-4a88-bf37-3c5bbe7a37bc} + + windefend_resource_assignment_v6 + windefend + + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_INSPECTION + {ced78e5f-1dd1-485a-9d35-7e44cc9d784d} + + 0 + + 68279 + + FWP_UINT64 + 0 + + + + {16dfd892-4fa5-4dc8-bf0f-2e94ffe6f1ba} + + Microsoft Store + Microsoft Store + + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6 + + 0 + + 68290 + + FWP_UINT64 + 10376434004072071168 + + + + + + + FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD + + ALE Resource Assignment v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_ALE_PROMISCUOUS_MODE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 39 + + + + + + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + + ALE Listen v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 40 + + + + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 + + WFP Built-in Edge Traversal ALE Listen v4 Layer Callout + Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000014 + + + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + 29 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0028} + + Windows Firewall: callout + Notifies the user. + + + FWPM_CALLOUT_FLAG_REGISTERED + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + 270 + + + + + {93f12f2b-665e-44f2-a229-f5af613fe690} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0028} + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67627 + + FWP_UINT64 + 9223372036854775840 + + + + {8f1a4c58-25f3-4358-84e9-4aaec8ab1398} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0028} + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67635 + + FWP_UINT64 + 3458764513820540960 + + + + {85bce91c-5ad3-4c13-978f-edfd66523835} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67696 + + FWP_UINT64 + 10376293542535364544 + + + + {18f77a24-0d44-4919-98e7-f42eb1002af3} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 + + 0 + + 67697 + + FWP_UINT64 + 10376293542535364544 + + + + {1a3b3a34-55b4-4791-aa77-28e1c9f4f78a} + + Wireless Display Infrastructure Back Channel (TCP-In) + Inbound rule for Wireless Display Infrastructure back channel [TCP] + + + FWPM_PROVIDER_MPSSVC_WF + + a500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000 + \device\harddiskvolume3\windows\system32\castsrv.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7250 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67709 + + FWP_UINT64 + 10376293542535364480 + + + + {7fb5698e-c641-4fbc-b851-13c666f5e3aa} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 + + 0 + + 67772 + + FWP_UINT64 + 10376293541461622976 + + + + {c3711cf1-9bff-4f13-abcb-3ffdc68015d3} + + XING + XING + + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 + + 0 + + 67784 + + FWP_UINT64 + 10376293541461622976 + + + + {fa41fb18-1600-4eb8-a46e-b1e892bdc894} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 + + 0 + + 67796 + + FWP_UINT64 + 10376293541461622976 + + + + {0ee2b732-6452-42b4-9a5e-bdb97e3a925a} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 + + 0 + + 67808 + + FWP_UINT64 + 10376293541461622976 + + + + {a11e4118-9942-4da1-bdbf-698fde8b5697} + + Microsoft Teams + Microsoft Teams + + + FWPM_PROVIDER_MPSSVC_WF + + b700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 + \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe + + + + + + FWP_ACTION_PERMIT + + + 0 + + 67820 + + FWP_UINT64 + 10376293541461622912 + + + + {066a6860-5fb4-4dd2-bbc9-8bac48b6a4d4} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 + + 0 + + 67828 + + FWP_UINT64 + 10376293541461622976 + + + + {185af45b-b8b0-4110-a5a3-9732ccf1a36a} + + Cortana + Cortana + + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 + + 0 + + 67840 + + FWP_UINT64 + 10376293541461622976 + + + + {6ed9f2bc-535f-4575-a1b3-56e98dfc52ad} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 554 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68220 + + FWP_UINT64 + 10376293542535364544 + + + + {86edf865-f5c6-4b10-9eaa-63371a7287a1} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 8554 + + + FWP_UINT16 + 8558 + + + + + + + FWP_ACTION_PERMIT + + + 0 + + 68223 + + FWP_UINT64 + 10376293542379542720 + + + + {a8c97be3-77f0-4ea7-b5f8-10d91d382e1e} + + Microsoft Store + Microsoft Store + + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_LISTEN_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4 + + 0 + + 68284 + + FWP_UINT64 + 10376293541461622976 + + + + + + + FWPM_LAYER_ALE_AUTH_LISTEN_V4_DISCARD + + ALE Listen v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 41 + + + + + + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + + ALE Listen v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 42 + + + + FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 + + WFP Built-in Edge Traversal ALE Listen v6 Layer Callout + Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000014 + + + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + 30 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e002a} + + Windows Firewall: callout + Notifies the user. + + + FWPM_CALLOUT_FLAG_REGISTERED + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + 271 + + + + + {a8568747-7e3e-4077-adc4-4ad699d10d4b} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e002a} + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67631 + + FWP_UINT64 + 9223372036854775840 + + + + {9412dbc5-7e4a-4296-9b6b-309a61de48b4} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e002a} + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67639 + + FWP_UINT64 + 3458764513820540960 + + + + {05a88866-6122-4377-9ca8-432cbe8f64c2} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67701 + + FWP_UINT64 + 10376293541528731584 + + + + {8b44e0b3-d691-4d4b-a7ff-4ab5c957d05e} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 + + 0 + + 67702 + + FWP_UINT64 + 10376293541528731584 + + + + {9d45f132-f86f-4c7b-8f71-32000ba2136a} + + Wireless Display Infrastructure Back Channel (TCP-In) + Inbound rule for Wireless Display Infrastructure back channel [TCP] + + + FWPM_PROVIDER_MPSSVC_WF + + a500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000 + \device\harddiskvolume3\windows\system32\castsrv.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7250 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67711 + + FWP_UINT64 + 10376293541528731520 + + + + {89449f5a-57ae-4ae5-ac86-e4b758669e07} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 + + 0 + + 67777 + + FWP_UINT64 + 10376293541461622976 + + + + {aedc9943-eac8-497d-acc6-0e7175b5074b} + + XING + XING + + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 + + 0 + + 67789 + + FWP_UINT64 + 10376293541461622976 + + + + {8a3fa42a-2fab-485a-afad-8bcfbf876471} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 + + 0 + + 67801 + + FWP_UINT64 + 10376293541461622976 + + + + {09bda0cc-b7d7-4eea-84a5-587667ae638a} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 + + 0 + + 67813 + + FWP_UINT64 + 10376293541461622976 + + + + {72f3c3d1-c6ff-4dc5-a385-a4cb9aad45f3} + + Microsoft Teams + Microsoft Teams + + + FWPM_PROVIDER_MPSSVC_WF + + b700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 + \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe + + + + + + FWP_ACTION_PERMIT + + + 0 + + 67822 + + FWP_UINT64 + 10376293541461622912 + + + + {f4ed1f0f-7a1a-4025-89e2-38e6bebc3db8} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 + + 0 + + 67833 + + FWP_UINT64 + 10376293541461622976 + + + + {b452f283-2ec7-44cd-92aa-7b832d56e019} + + Cortana + Cortana + + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 + + 0 + + 67845 + + FWP_UINT64 + 10376293541461622976 + + + + {109e4154-56f4-4c4f-92d4-40cd1dc644ce} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 554 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68226 + + FWP_UINT64 + 10376293541528731584 + + + + {ea58a6ce-9d6b-46f2-9d4c-a1977a154b5b} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 8554 + + + FWP_UINT16 + 8558 + + + + + + + FWP_ACTION_PERMIT + + + 0 + + 68229 + + FWP_UINT64 + 10376293541518992832 + + + + {e65cf284-71bb-4869-b2ba-c9a7051d20fc} + + Microsoft Store + Microsoft Store + + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_LISTEN_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_CALLOUT_TERMINATING + FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6 + + 0 + + 68289 + + FWP_UINT64 + 10376293541461622976 + + + + + + + FWPM_LAYER_ALE_AUTH_LISTEN_V6_DISCARD + + ALE Listen v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 43 + + + + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + + ALE Receive/Accept v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_NAP_CONTEXT + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_REAUTHORIZE_REASON + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 44 + + + + FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V4 + + WFP Built-in IPsec Inbound Initiate Secure v4 Layer Callout + Verifies that each incoming connection that is supposed to arrive secure arrives securely. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + 13 + + + FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V4 + + WFP Built-in TCP Chimney Offload ALE Receive/Accept v4 Layer Callout + Enables or disables TCP Chimney Offload for each incoming connection. + + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + 21 + + + FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V4 + + WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v4 Layer Callout + Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + 25 + + + FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V4 + + WFP Built-in TCP Templates ALE Receive/Accept v4 Layer Callout + Applies TCP Template for each incoming connection. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + 35 + + + FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4 + + WFP Built-in Set Option ALE Receive/Accept v4 Layer Callout + Sets classify options on inbound flows. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + 39 + + + FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V4 + + WFP Built-in Policy Silent Mode ALE Receive/Accept v4 Layer Callout + Audit and log policy for incoming connection. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + 43 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e022c} + + Windows Firewall: callout + Allows secondary connections. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + 284 + + + + + {c970a45d-57f9-4e32-a5bd-886a9662641e} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 8388608 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66214 + + FWP_UINT64 + 18446744073709551615 + + + + {716b48eb-0a35-4a76-92ab-1d987230d288} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 8388608 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66218 + + FWP_UINT64 + 18446744073709551615 + + + + {a47525e2-725b-4888-8af1-ba5a60c04f4d} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66226 + + FWP_UINT64 + 0 + + + + {13bfd422-6f75-4408-8924-9400ec0cb19c} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66230 + + FWP_UINT64 + 0 + + + + {c42f1cd6-3a95-4ae2-a513-793c3ae610c7} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66235 + + FWP_UINT64 + 35165044736 + + + + {3697a558-3ed3-49be-a4c1-c1a4448653b4} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66237 + + FWP_UINT64 + 35165044736 + + + + {d870c96c-75ee-46a6-8a02-8e4401a73423} + + Quarantine Default Inbound Block + This filter blocks any inbound non-loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66241 + + FWP_UINT64 + 34359738368 + + + + {4137b143-2770-43d4-91a2-55bb0a069830} + + Quarantine Default Inbound Tunnel Exception + This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66247 + + FWP_UINT64 + 1152921539503456256 + + + + {17043d46-fac2-4561-bca1-0c7a05e95f5f} + + Quarantine Default Inbound Next Hop Tunnel Exception + This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66249 + + FWP_UINT64 + 1152921539503456256 + + + + {4e718c57-c397-4221-9fbb-14fd51701d6a} + + Quarantine Default Inbound DHCP Exception + This filter allows for DHCP connections when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 68 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 67 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66251 + + FWP_UINT64 + 1154899560384954368 + + + + {916c0dbf-7cec-40f9-9dd9-a5e68b904510} + + Quarantine Default Inbound Loopback Exception + This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66599 + + FWP_UINT64 + 18446744073709551615 + + + + {89a89b7c-b5ab-4ed6-bf05-d3059281a5c5} + + AppContainerBoottimeFilter + Boottime filter for App Containers + + + FWPM_FILTER_FLAG_BOOTTIME + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4194304 + + + + + FWP_ACTION_PERMIT + + + 0 + + 66995 + + FWP_UINT64 + 18446744073709551615 + + + + {e72646bc-7d3f-4c5c-a679-b3716f8c6cc8} + + AppContainerBoottimeFilter + Boottime filter for App Containers + + + FWPM_FILTER_FLAG_PERSISTENT + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4194304 + + + + + FWP_ACTION_PERMIT + + + 0 + + 66997 + + FWP_UINT64 + 18446744073709551615 + + + + {21c48193-9ccd-4faf-9590-99b6e4c8af2c} + + AppContainerLoopback + This filter allows non-AppContainers to receive loopback traffic from other non-AppContainers + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 8388608 + + + + + FWP_ACTION_PERMIT + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67190 + + FWP_UINT64 + 18446744073709551615 + + + + {7a5bb72c-0e75-4ad6-ae8a-9ffd591bb744} + + AppContainerLoopback + This filter allows non-AppContainers to receive loopback traffic from by policy allowed AppContainers + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 16777216 + + + + + FWP_ACTION_PERMIT + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67192 + + FWP_UINT64 + 18446744073709551615 + + + + {19a19270-e1ff-433e-a9a7-c2fd8fb46bcb} + + AppContainerLoopback + This filter allows an AppContainer to receive loopback traffic from itself + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4194304 + + + + + FWP_ACTION_PERMIT + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67194 + + FWP_UINT64 + 18446744073709551615 + + + + {1ea45d61-721b-47aa-9b19-81422ba8fdec} + + AppContainerLoopback + This filter blocks AppContainer loopback traffic + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551614 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_BLOCK + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67200 + + FWP_UINT64 + 18446744073709551614 + + + + {558d57ba-cc4e-4bde-8ea0-8120605580b4} + + Interface Un-quarantine filter + + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWP_MATCH_EQUAL + + FWP_UINT64 + 0 + + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWP_MATCH_EQUAL + + FWP_UINT64 + 6755399441055744 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67453 + + FWP_UINT64 + 4503633987108866 + + + + {4ff11138-2d2f-4fcf-a884-d0be3936bc57} + + Interface Un-quarantine filter + + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWP_MATCH_EQUAL + + FWP_UINT64 + 0 + + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWP_MATCH_EQUAL + + FWP_UINT64 + 6755399441055744 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67454 + + FWP_UINT64 + 4503633987108866 + + + + {b1686938-d80f-429d-b7d8-735a34b3605b} + + Interface Un-quarantine filter + + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWP_MATCH_EQUAL + + FWP_UINT64 + 10000001 + + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWP_MATCH_EQUAL + + FWP_UINT64 + 1689399632855040 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67457 + + FWP_UINT64 + 4503633987108866 + + + + {f708e179-0005-47bc-9659-9c9af4525161} + + Interface Un-quarantine filter + + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWP_MATCH_EQUAL + + FWP_UINT64 + 10000001 + + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWP_MATCH_EQUAL + + FWP_UINT64 + 1689399632855040 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67458 + + FWP_UINT64 + 4503633987108866 + + + + {3668a51e-18e1-4b90-a348-1b26820075ee} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67630 + + FWP_UINT64 + 9223372036854776704 + + + + {996c5681-e762-4131-ba41-a4b2ba434af4} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWP_ACTION_BLOCK + + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67638 + + FWP_UINT64 + 3458764513820540928 + + + + {e4bf8fce-257a-409d-82a9-c1d0de1706ef} + + UWP Default Inbound Block Rule + This is the UWP Default Inbound Block filter. This filter blocks any inbound packets to UWP apps that do not have the correct capability tokens for listening to a resource. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 9900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + {b36473ef-bf42-49b9-ac24-adba245e825c} + + 67657 + + FWP_UINT64 + 549755813888 + + + + {f6ac8f41-9cbd-478e-97ca-93406509632b} + + Core Networking - IPv6 (IPv6-In) + Inbound rule required to permit IPv6 traffic for ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) and 6to4 tunnelling services. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9b00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 41 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67661 + + FWP_UINT64 + 10377982941077700608 + + + + {46ea0820-54e9-4671-9ee4-b5efa03e7fb2} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67665 + + FWP_UINT64 + 10378264690932318208 + + + + {9ed57c1d-5a7c-4821-85c1-bb4d5b005495} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67666 + + FWP_UINT64 + 10378264691737624576 + + + + {20aa0d80-0876-40ab-9060-81fa4852b804} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67667 + + FWP_UINT64 + 10378264726097362944 + + + + {1d948ce2-c67e-4612-9a13-a86146c93899} + + Core Networking - Destination Unreachable Fragmentation Needed (ICMPv4-In) + Destination Unreachable Fragmentation Needed error messages are sent from any node that a packet traverses which is unable to forward the packet because fragmentation was needed and the don't fragment bit was set. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9e00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67676 + + FWP_UINT64 + 10378272112635805696 + + + + {4a6c385c-4d41-422e-80e2-a0a8ed98e329} + + Core Networking - Dynamic Host Configuration Protocol (DHCP-In) + Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9f00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 68 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 67 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67678 + + FWP_UINT64 + 10378272387513712640 + + + + {9858d0f0-9bcd-4854-b300-54482931a983} + + Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In) + Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a000000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 546 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 547 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67682 + + FWP_UINT64 + 10378272387513712640 + + + + {d864789f-7916-44d6-92d2-89c3cb3339ce} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67698 + + FWP_UINT64 + 10378264690932318208 + + + + {fa6ddfcb-e0e4-4e81-851e-bcc403c08a55} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67699 + + FWP_UINT64 + 10378264691737624576 + + + + {626051d7-734b-4953-9c98-0b07643b6ca2} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67700 + + FWP_UINT64 + 10378264726097362944 + + + + {db7d8fea-b0d0-47b8-ac4c-926e2d6fa47f} + + Wireless Display Infrastructure Back Channel (TCP-In) + Inbound rule for Wireless Display Infrastructure back channel [TCP] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000 + \device\harddiskvolume3\windows\system32\castsrv.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7250 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67710 + + FWP_UINT64 + 10378264416054411264 + + + + {be661f2c-e574-4046-8c33-f35b7d29a7e4} + + Core Networking - Internet Group Management Protocol (IGMP-In) + IGMP messages are sent and received by nodes to create, join and depart multicast groups. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ac00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 2 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67747 + + FWP_UINT64 + 10377982941077700608 + + + + {ead521c1-9552-4d43-8a5c-ceb57aca1dc8} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67774 + + FWP_UINT64 + 10376294366095343616 + + + + {1c30209e-d2ce-4392-9e8f-f377efb005e5} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67775 + + FWP_UINT64 + 10376294366900649984 + + + + {22519d4f-2ea3-4e42-8963-d6f0b7733aa2} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67776 + + FWP_UINT64 + 10376294401260388352 + + + + {29c7768e-567b-4383-9274-88ce90b281c8} + + XING + XING + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67786 + + FWP_UINT64 + 10376294366095343616 + + + + {d6953602-d25c-44c8-89be-32af54554764} + + XING + XING + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67787 + + FWP_UINT64 + 10376294366900649984 + + + + {1d52280a-5200-4f1b-b9f2-ff576ef4721e} + + XING + XING + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67788 + + FWP_UINT64 + 10376294401260388352 + + + + {22d44aac-6653-4e7b-aa73-9e3f59633d4f} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67798 + + FWP_UINT64 + 10376294366095343616 + + + + {d6346862-1e03-4aeb-ba63-df5639ea6fec} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67799 + + FWP_UINT64 + 10376294366900649984 + + + + {6f8d75fc-f3b5-4016-81e2-4f2df77168cf} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67800 + + FWP_UINT64 + 10376294401260388352 + + + + {c041bcbc-c3b0-4002-9e12-424d925ac610} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67810 + + FWP_UINT64 + 10376294366095343616 + + + + {ed0b7196-2d26-4cf8-8de9-ae943554347d} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67811 + + FWP_UINT64 + 10376294366900649984 + + + + {d45600c9-f182-43ae-b1ea-40ebdeea9b99} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67812 + + FWP_UINT64 + 10376294401260388352 + + + + {b6cc72ea-22a1-483e-9636-090bb5302940} + + Microsoft Teams + Microsoft Teams + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 + \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67821 + + FWP_UINT64 + 10377982941077700608 + + + + {5bd7313e-64c8-4956-a5d5-a598afeeaea0} + + Microsoft Teams + Microsoft Teams + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 + \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67825 + + FWP_UINT64 + 10377982941077700608 + + + + {ec36ba3d-18ff-43c9-a323-bd61ebf5cdf9} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67830 + + FWP_UINT64 + 10376294366095343616 + + + + {50aedebf-9228-41e5-826c-880c0dfeeeb9} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67831 + + FWP_UINT64 + 10376294366900649984 + + + + {fce876c5-0650-4cf0-a8e5-32763f4572db} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67832 + + FWP_UINT64 + 10376294401260388352 + + + + {8075d897-3b61-4b0d-a1b7-8cf360304598} + + Cortana + Cortana + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67842 + + FWP_UINT64 + 10376294366095343616 + + + + {e2918c6c-304d-4dba-a100-4c19a688541d} + + Cortana + Cortana + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67843 + + FWP_UINT64 + 10376294366900649984 + + + + {41000d2a-eba0-40b3-93b1-42d9352f0b1f} + + Cortana + Cortana + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67844 + + FWP_UINT64 + 10376294401260388352 + + + + {e7abd6b3-64e1-456b-9de4-80bd51c45892} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + bb00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67853 + + FWP_UINT64 + 10378264416054411264 + + + + {3474e056-188f-44cd-bf0e-f2b9395d00b1} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + bd00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67869 + + FWP_UINT64 + 10378264416054411264 + + + + {3bba491b-aba5-4198-9599-0560f76b1c4d} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + be00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67873 + + FWP_UINT64 + 10378264416054411264 + + + + {6236913c-4c2a-430b-817d-4c4fcde825ee} + + Allow inbound UDP traffic to CDPSvc port 5050 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c200000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5050 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67878 + + FWP_UINT64 + 1971149470695424 + + + + {66924806-dccf-403e-97a9-14fcc9d64f9a} + + Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5160 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67888 + + FWP_UINT64 + 1971149470695424 + + + + {1cf98e43-5bb6-4020-8666-ff5dc7a76123} + + Allow inbound TCP traffic to CDPSvc from any port to port 5040 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5040 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67892 + + FWP_UINT64 + 1971149470695424 + + + + {215327fd-5d26-4b42-9e18-ee1e1f871285} + + Block inbound traffic to omadmclient.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ca00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 + \device\harddiskvolume3\windows\system32\omadmclient.exe + + + + + + FWP_ACTION_BLOCK + + + {a8b55da6-3aba-41f3-b7ba-443233f64fce} + + 67894 + + FWP_UINT64 + 549755813888 + + + + {9bce6a19-81a8-4ff2-8fe8-e63940b2f706} + + Block inbound traffic to deviceenroller.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + cb00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\deviceenroller.exe + + + + + + FWP_ACTION_BLOCK + + + {c4e61e5c-3e66-4efb-b22b-87f8e56cf9c2} + + 67896 + + FWP_UINT64 + 549755813888 + + + + {2ea83abb-f047-4edc-857d-4776be7ddb86} + + Block inbound traffic to dmcertinst.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + d000000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\dmcertinst.exe + + + + + + FWP_ACTION_BLOCK + + + {616fdcf3-1169-46b5-8224-cffc7276af2e} + + 67906 + + FWP_UINT64 + 549755813888 + + + + {dd658fab-9acd-48c8-9faf-a0e67d88ca4c} + + DhcpFirewallPolicy + DhcpFirewallPolicy + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 68 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 67 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67916 + + FWP_UINT64 + 1978846052089856 + + + + {38119412-b39e-48a6-8fcd-1e7dedc4be5e} + + DhcpFirewallPolicy + DhcpFirewallPolicy + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 546 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 547 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67918 + + FWP_UINT64 + 1978846052089856 + + + + {f4e952f7-52be-4ea6-abb2-90f88debea25} + + Allow RPC/TCP traffic to EventLog + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67924 + + FWP_UINT64 + 1689691673853952 + + + + {c76886bf-c4ec-4208-8833-3b243baba297} + + Allow inbound UDP traffic to fdphost port 3702 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + da00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67926 + + FWP_UINT64 + 1971149470695424 + + + + {01569aae-88e0-4cfd-98c5-714f5a86ee63} + + Allow inbound UDP traffic to fdphost port 1900 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + dc00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 1900 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67930 + + FWP_UINT64 + 1971149470695424 + + + + {4e359e41-d670-4727-a4df-48984e785c40} + + Allow inbound TCP traffic to AJRouter + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 9955 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67940 + + FWP_UINT64 + 1971149470695424 + + + + {88e8faac-2f47-487a-a93f-709d1cb0bf7b} + + Allow inbound UDP traffic to AJRouter + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e200000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67942 + + FWP_UINT64 + 1689674493984768 + + + + {ac4aaa1b-a5f2-41fa-b624-39f34a249fe4} + + Allow Grouping to receive from port 3587 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3587 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67948 + + FWP_UINT64 + 1971149470695424 + + + + {1f67d6c0-f1de-4524-a4a7-8a93b03238b2} + + Allow PNRP to send to port 3540 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3540 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67952 + + FWP_UINT64 + 1971149470695424 + + + + {c68ac2bf-ad79-4aaf-a764-a9de591a17f3} + + IPsec Policy Agent service hardening - Remote Management + Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + eb00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67960 + + FWP_UINT64 + 1689691673853952 + + + + {9b2018aa-486c-4b5e-9a4c-a1b96ecf2cbc} + + Block all inbound traffic to SearchFilterHost + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ec00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\searchfilterhost.exe + + + + + + FWP_ACTION_BLOCK + + + {3a5e8a34-82df-4083-a6ed-87ea8ed3507a} + + 67962 + + FWP_UINT64 + 549755813888 + + + + {27db903a-7e87-41ff-8a17-31ca20c9fb16} + + Block all inbound traffic to SearchProtocolHost + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ef00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\searchprotocolhost.exe + + + + + + FWP_ACTION_BLOCK + + + {c0cedbe2-34f4-4491-bd19-152a55b1b6e0} + + 67968 + + FWP_UINT64 + 549755813888 + + + + {bd84fe34-f5b3-48c8-90f7-3f647e9bebe3} + + Allow inbound UDP traffic to SNMPTRAP service + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f000000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000 + \device\harddiskvolume3\windows\system32\snmptrap.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67970 + + FWP_UINT64 + 1689674493984768 + + + + {c718ce9d-2f72-430c-beeb-789fa9d7c5ea} + + Allow all inbound TCP and RPC to SPPEXTCOMOBJ + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000 + \device\harddiskvolume3\windows\system32\sppextcomobj.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67972 + + FWP_UINT64 + 1689674493984768 + + + + {bdc0147f-ebdd-4b25-a20a-5c3ed10cbd3f} + + TermServiceLOM + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67976 + + FWP_UINT64 + 1689674493984768 + + + + {3ddc2b0e-33e3-417b-a578-019a4df4b502} + + TermServiceLOM + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_INSPECTION + FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4 + + {2ea412db-5c9d-4bbd-9af2-4914d2dbfe17} + + 67977 + + FWP_UINT64 + 18446744073709551615 + + + + {d9a39ed3-698d-434e-83e1-f8a75a5b6a31} + + Allow incoming RPC traffic to VDS + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000 + \device\harddiskvolume3\windows\system32\vds.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67980 + + FWP_UINT64 + 1689691673853952 + + + + {ff843ce9-c5e3-49a0-84d2-cdfa59928fc7} + + Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 389 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67982 + + FWP_UINT64 + 1971149470695424 + + + + {810b03cc-8f67-4991-bf02-fe78e19477c2} + + Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 636 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67983 + + FWP_UINT64 + 1971149470695424 + + + + {4e788a24-1c9a-4fe2-bfbc-a7c10bd5bd7e} + + Allow inbound UDP traffic to NTP port 123 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 123 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67988 + + FWP_UINT64 + 1971149470695424 + + + + {b14b6b1e-1bfe-4dfd-8a8e-393da4d4b226} + + Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000 + \device\harddiskvolume3\windows\system32\wbengine.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67992 + + FWP_UINT64 + 1689691673853952 + + + + {865a8428-bb5e-4b7b-8473-b06bf1b69edb} + + Cast to Device streaming server hardening rules for RTSP + Allow incoming RTSP connections to the Cast to Device streaming server + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0201000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\mdeserver.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 23554 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68014 + + FWP_UINT64 + 1970874592788480 + + + + {d12a44b6-3150-4214-997f-0735fad61441} + + Cast to Device streaming server hardening rules for RTSP + Allow incoming RTSP connections to the Cast to Device streaming server + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0201000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\mdeserver.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 23555 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68015 + + FWP_UINT64 + 1970874592788480 + + + + {690e53fb-c3c2-4e74-a58a-b627852bff69} + + Cast to Device streaming server hardening rules for RTSP + Allow incoming RTSP connections to the Cast to Device streaming server + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0201000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\mdeserver.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 23556 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68016 + + FWP_UINT64 + 1970874592788480 + + + + {c3b150a5-0e63-4acf-99d8-93fa101c9f4c} + + Allow incoming TCP to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0301000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68020 + + FWP_UINT64 + 1689674493984768 + + + + {cc829f3a-8ac5-461d-bf9e-b53fa92bf4a6} + + Windows Media Player Network Sharing Service service hardening - RTSP + Allow incoming RTSP connections to the Windows Media Player Network Sharing Service + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0901000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000 + \device\harddiskvolume3\program files\windows media player\wmpnetwk.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 554 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68040 + + FWP_UINT64 + 1971149470695424 + + + + {81b5a3ad-8373-4dda-8234-524b6d6411f7} + + Windows Media Player Network Sharing Service service hardening - RTSP + Allow incoming RTSP connections to the Windows Media Player Network Sharing Service + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0901000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000 + \device\harddiskvolume3\program files\windows media player\wmpnetwk.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 8554 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68041 + + FWP_UINT64 + 1971149470695424 + + + + {6c2e5205-ac93-4a93-945a-9d07d7f97ff7} + + WSH Default Inbound Block + Blocks all inbound traffic for services who have been network hardened + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3914275374-678031271-1603343729-3906112567-2888048264)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL + + + + + FWP_ACTION_BLOCK + + + {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} + + 68047 + + FWP_UINT64 + 274877906944 + + + + {36e4f41f-09b7-4858-a3f7-1f07b2f62dcf} + + FTP Inspection Filter + This filter enables inspection of FTP. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 1024 + + + FWP_UINT16 + 65535 + + + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e022c} + + 0 + + 68052 + + FWP_UINT64 + 18446744073709551615 + + + + {52c05a69-b7bd-471e-90f6-b4165265dee2} + + InternetClientServer Inbound Default Rule + InternetClientServer Inbound Default Rule + + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 1c01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 0.0.0.0 + + + FWP_UINT32 + 255.255.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 68208 + + FWP_UINT64 + 824633721848 + + + + {de8c0919-fdae-4263-9186-3209ef7a9203} + + Microsoft Media Foundation Network Source IN [UDP 5004-5009] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 1f01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5000 + + + FWP_UINT16 + 5020 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68215 + + FWP_UINT64 + 10882588684629049344 + + + + {2f69ffa4-769a-4f40-a565-b54847821e5b} + + Microsoft Media Foundation Network Source IN [UDP 5004-5009] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 1f01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5000 + + + FWP_UINT16 + 5020 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68216 + + FWP_UINT64 + 10882588718988787712 + + + + {11dd8bd8-1210-4a7e-adb2-460cf2b6a1c1} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 554 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68221 + + FWP_UINT64 + 10882667849466249216 + + + + {d9e43dad-f679-4f2f-973d-26827bb8c8d3} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 554 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68222 + + FWP_UINT64 + 10882667883825987584 + + + + {9ce6ee0e-7cfb-4b36-bc70-a57d7a63f100} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 8554 + + + FWP_UINT16 + 8558 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68224 + + FWP_UINT64 + 10882623869001138176 + + + + {80750116-2e93-43ec-8465-40d3dbf5c900} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 8554 + + + FWP_UINT16 + 8558 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68225 + + FWP_UINT64 + 10882623903360876544 + + + + {e43d0b2d-6a0f-432b-91a1-504f070a7035} + + WFD ASP Coordination Protocol (UDP-In) + Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2201000000000000 + "....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68235 + + FWP_UINT64 + 10882675546047643648 + + + + {1c5d0851-defc-4241-8f7f-20f4ce925d56} + + WFD ASP Coordination Protocol (UDP-In) + Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2201000000000000 + "....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68236 + + FWP_UINT64 + 10882675580407382016 + + + + {353edb90-351b-439f-bb1a-499f3ee0d611} + + mDNS (UDP-In) + Inbound rule for mDNS traffic [UDP] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2601000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68247 + + FWP_UINT64 + 10882667849466249216 + + + + {acfb0f39-be2d-43a6-a260-1b6ea1aa107d} + + mDNS (UDP-In) + Inbound rule for mDNS traffic [UDP] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2601000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68248 + + FWP_UINT64 + 10882667883825987584 + + + + {9f4f259a-998a-4cad-b318-aeab2fccb2d1} + + Wi-Fi Direct ASP Coordination Protocol (UDP-In) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2701000000000000 + '....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68252 + + FWP_UINT64 + 506382004586020864 + + + + {826bf713-3f53-422d-9ab6-f66251968bdf} + + Wi-Fi Direct ASP Coordination Protocol (UDP-In) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2701000000000000 + '....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68253 + + FWP_UINT64 + 506382038945759232 + + + + {f7b10da2-52b3-4496-af84-a4141986b1fb} + + Allow incoming WSD to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2901000000000000 + )....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68260 + + FWP_UINT64 + 506374308004626432 + + + + {a2e9e943-0681-4a0e-8c58-485b3ceff496} + + Allow incoming WSD to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2901000000000000 + )....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68261 + + FWP_UINT64 + 506374342364364800 + + + + {0ae65187-1f62-4d22-9fde-4f60caac6393} + + Allow incoming WSD to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2a01000000000000 + *....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68264 + + FWP_UINT64 + 506100529609310208 + + + + {7184c665-64f2-476c-af5a-01cc74b700da} + + Allow incoming WSD to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2a01000000000000 + *....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68265 + + FWP_UINT64 + 506100563969048576 + + + + {d69d41e1-ee28-47d3-90a0-4e0eef6a868f} + + Microsoft Store + Microsoft Store + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 68286 + + FWP_UINT64 + 10376294366095343616 + + + + {4442f710-abac-421f-9d4f-f02939d23c63} + + Microsoft Store + Microsoft Store + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68287 + + FWP_UINT64 + 10376294366900649984 + + + + {d68c9ba7-1425-44da-b537-7642ce5bbe9d} + + Microsoft Store + Microsoft Store + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68288 + + FWP_UINT64 + 10376294401260388352 + + + + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD + + ALE Receive/Accept v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_NAP_CONTEXT + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_REAUTHORIZE_REASON + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 45 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e012d} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD + 278 + + + + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + + ALE Receive/Accept v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_NAP_CONTEXT + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_REAUTHORIZE_REASON + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 46 + + + + FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V6 + + WFP Built-in IPsec Inbound Initiate Secure v6 Layer Callout + Verifies that each incoming connection that is supposed to arrive secure arrives securely. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + 14 + + + FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V6 + + WFP Built-in TCP Chimney Offload ALE Receive/Accept v6 Layer Callout + Enables or disables TCP Chimney Offload for each incoming connection. + + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + 22 + + + FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V6 + + WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v6 Layer Callout + Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + 26 + + + FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V6 + + WFP Built-in TCP Templates ALE Receive/Accept v6 Layer Callout + Applies TCP Template for each incoming connection. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + 36 + + + FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6 + + WFP Built-in Set Option ALE Receive/Accept v6 Layer Callout + Sets classify options on inbound flows. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + 40 + + + FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V6 + + WFP Built-in Policy Silent Mode ALE Receive/Accept v6 Layer Callout + Audit and log policy for incoming connection. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + 44 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e022e} + + Windows Firewall: callout + Allows secondary connections. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + 285 + + + + + {dc95b53e-01cf-4058-821d-350b3d0d4676} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66210 + + FWP_UINT64 + 1153167795211468800 + + + + {f444c576-6e60-4ea2-9faa-80d57ed12cd2} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66211 + + FWP_UINT64 + 1153167795211468800 + + + + {0c3be01b-fe70-4cc4-89dc-c07996b67e6d} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 8388608 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66215 + + FWP_UINT64 + 18446744073709551615 + + + + {1165065e-4996-4338-abaf-4b8556b4d431} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 8388608 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66219 + + FWP_UINT64 + 18446744073709551615 + + + + {0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66227 + + FWP_UINT64 + 0 + + + + {cbfb56db-3c85-4543-9bc2-76ea28cdd74e} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 0 + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66231 + + FWP_UINT64 + 0 + + + + {2dd96961-5757-434f-b617-34e732517c0e} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66232 + + FWP_UINT64 + 8992587776 + + + + {375fb39b-08c6-40f2-bdf2-08fa63f970a2} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66233 + + FWP_UINT64 + 8992587776 + + + + {2db25e6c-f07a-44f4-b6c8-50a330d2790b} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_BOOTTIME + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66234 + + FWP_UINT64 + 8992587776 + + + + {b6fdab6b-dcc6-43e3-99ce-7aeca65063a4} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66236 + + FWP_UINT64 + 8992587776 + + + + {b02a4013-b6b5-4859-9168-1e3299e43b24} + + Quarantine Default Inbound Block + This filter blocks any inbound non-loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66240 + + FWP_UINT64 + 8589934592 + + + + {8b50e2ec-7cf0-4b71-b42e-5b0536f6cab8} + + Quarantine Default Inbound Tunnel Exception + This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66246 + + FWP_UINT64 + 1152921513465217024 + + + + {3180114b-8338-4740-9a16-444134ad62f4} + + Quarantine Default Inbound Next Hop Tunnel Exception + This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66248 + + FWP_UINT64 + 1152921513465217024 + + + + {567d3836-3f5b-4067-b9c4-952f677010a2} + + Quarantine Default Inbound Neighbor Discovery Exception + This filter allows for Neighbor Discovery when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66250 + + FWP_UINT64 + 1153167795211468800 + + + + {3a90a266-1519-4d23-911b-e84cd0f02ab8} + + Quarantine Default Inbound DHCP Exception + This filter allows for DHCP connections when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 546 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 547 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66252 + + FWP_UINT64 + 1153169727946752000 + + + + {0593d9b7-8e2b-44b1-9f9e-2831da1c9bd9} + + Quarantine Default Inbound Loopback Exception + This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66598 + + FWP_UINT64 + 18446744073709551615 + + + + {70694559-714a-4a38-a0cd-51439e06f1d8} + + Quarantine Default Inbound ICMP Exception + This filter allows for ICMP connections when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66602 + + FWP_UINT64 + 1225225526688350208 + + + + {84750a0c-b836-48e3-ab80-104985c857db} + + AppContainerBoottimeFilter + Boottime filter for App Containers + + + FWPM_FILTER_FLAG_BOOTTIME + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4194304 + + + + + FWP_ACTION_PERMIT + + + 0 + + 66996 + + FWP_UINT64 + 18446744073709551615 + + + + {b98b75dc-17c0-4e84-bd4e-2080527ca6a6} + + AppContainerBoottimeFilter + Boottime filter for App Containers + + + FWPM_FILTER_FLAG_PERSISTENT + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4194304 + + + + + FWP_ACTION_PERMIT + + + 0 + + 66998 + + FWP_UINT64 + 18446744073709551615 + + + + {5e48f4ad-9f6c-4c4e-a83a-d1ac10317436} + + Teredo socket option opt out block filter + + + + {c698301d-9129-450c-937c-f4b834bfb374} + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + {7b6b11f6-cbb5-433c-ae06-6a4f0076e49e} + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_BLOCK + + + 0 + + 67005 + + FWP_UINT64 + 18446744073709551615 + + + + {6109847e-3461-46a7-8bbb-58bd48643bf0} + + AppContainerLoopback + This filter allows non-AppContainers to receive loopback traffic from other non-AppContainers + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 8388608 + + + + + FWP_ACTION_PERMIT + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67191 + + FWP_UINT64 + 18446744073709551615 + + + + {1f1a43af-2fa5-4f1a-8d8e-395b07d53b24} + + AppContainerLoopback + This filter allows non-AppContainers to receive loopback traffic from by policy allowed AppContainers + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 16777216 + + + + + FWP_ACTION_PERMIT + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67193 + + FWP_UINT64 + 18446744073709551615 + + + + {a974e5b7-ff22-43d9-a813-01c5d1283b2e} + + AppContainerLoopback + This filter allows an AppContainer to receive loopback traffic from itself + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4194304 + + + + + FWP_ACTION_PERMIT + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67195 + + FWP_UINT64 + 18446744073709551615 + + + + {e3ac824d-4754-4603-80fb-48fe7450e46b} + + AppContainerLoopback + This filter blocks AppContainer loopback traffic + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551614 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_BLOCK + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67201 + + FWP_UINT64 + 18446744073709551614 + + + + {36bb2266-0f81-4937-af6b-63086254e9df} + + Interface Un-quarantine filter + + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWP_MATCH_EQUAL + + FWP_UINT64 + 0 + + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWP_MATCH_EQUAL + + FWP_UINT64 + 6755399441055744 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67455 + + FWP_UINT64 + 562958543355906 + + + + {d3e85111-30f5-4ff0-850f-8622624aadcf} + + Interface Un-quarantine filter + + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWP_MATCH_EQUAL + + FWP_UINT64 + 0 + + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWP_MATCH_EQUAL + + FWP_UINT64 + 6755399441055744 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67456 + + FWP_UINT64 + 562958543355906 + + + + {8c9a53ad-9d03-4280-9e0a-53754eb303bd} + + Interface Un-quarantine filter + + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWP_MATCH_EQUAL + + FWP_UINT64 + 10000002 + + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWP_MATCH_EQUAL + + FWP_UINT64 + 1689399632855040 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67459 + + FWP_UINT64 + 562958543355906 + + + + {8540bba7-40c4-4959-85fd-c082688a1176} + + Interface Un-quarantine filter + + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT8 + 0 + + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWP_MATCH_EQUAL + + FWP_UINT64 + 10000002 + + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWP_MATCH_EQUAL + + FWP_UINT64 + 1689399632855040 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67460 + + FWP_UINT64 + 562958543355906 + + + + {6fc5fe31-8779-4b15-9576-3ba7ff0b0ce4} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_BLOCK + + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67634 + + FWP_UINT64 + 9223372036854776768 + + + + {569702e8-0383-45e2-a938-743a0b269a89} + + Query User + Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + 9400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWP_ACTION_BLOCK + + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + 67642 + + FWP_UINT64 + 3458764513820540928 + + + + {c833a355-c4ff-4504-ba03-e56b2edcf0b2} + + UWP Default Inbound Block Rule + This is the UWP Default Inbound Block filter. This filter blocks any inbound packets to UWP apps that do not have the correct capability tokens for listening to a resource. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 9900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + {b36473ef-bf42-49b9-ac24-adba245e825c} + + 67658 + + FWP_UINT64 + 137438953472 + + + + {1c63c63e-acc4-4ef8-b31e-a3c7156292df} + + Core Networking - IPv6 (IPv6-In) + Inbound rule required to permit IPv6 traffic for ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) and 6to4 tunnelling services. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9b00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 41 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67662 + + FWP_UINT64 + 10376504785133109248 + + + + {b9346349-afa6-45c1-875e-5e12437b1648} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67670 + + FWP_UINT64 + 10376540038224674816 + + + + {e0e890e5-0dbb-449d-926f-36ecc0d32307} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67671 + + FWP_UINT64 + 10376540038627328000 + + + + {79923371-5423-4aa7-9d60-86afaac5ce75} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67672 + + FWP_UINT64 + 10376540047217262592 + + + + {e67d1661-76e2-4fdf-bbab-5f1cd28e3ea4} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67673 + + FWP_UINT64 + 10376540038627328000 + + + + {72a57651-9ca9-4550-ba15-cb5c797b3281} + + Delivery Optimization (UDP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9c00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67674 + + FWP_UINT64 + 10376540047217262592 + + + + {9ee8af53-7d0c-48f1-892e-3038f67c8771} + + Core Networking - Router Advertisement (ICMPv6-In) + Router Advertisement messages are sent by routers to other nodes for stateless auto-configuration. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9d00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67675 + + FWP_UINT64 + 10664770345656909824 + + + + {269d6a27-dcd7-4d83-8e64-34e06f1fab75} + + Core Networking - Dynamic Host Configuration Protocol (DHCP-In) + Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 9f00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 68 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 67 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67680 + + FWP_UINT64 + 10376541962370023424 + + + + {4f4f8d89-0d09-4170-91e5-b50e05fd12ba} + + Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In) + Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a000000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 546 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 547 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67684 + + FWP_UINT64 + 10376541962370023424 + + + + {dc4fed41-3e88-48ec-8363-d1dabe968953} + + Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) + Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67685 + + FWP_UINT64 + 10376539969505198080 + + + + {24a4ff08-78cb-425a-8412-de0c6eee513f} + + Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) + Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67686 + + FWP_UINT64 + 10376539969907851264 + + + + {925f3a0e-53c9-4c55-8506-1a50be54a688} + + Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) + Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67687 + + FWP_UINT64 + 10376539978497785856 + + + + {b0c5f46c-f20b-455a-94a5-ba616b03ba89} + + Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) + Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67688 + + FWP_UINT64 + 10376539969907851264 + + + + {7c5bf10d-2519-47ac-9864-28272c35ecd6} + + Core Networking - Neighbour Discovery Solicitation (ICMPv6-In) + Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67689 + + FWP_UINT64 + 10376539978497785856 + + + + {b0a2ee9b-60e1-4c3a-a2e8-db6ffaec87e2} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67703 + + FWP_UINT64 + 10376540038224674816 + + + + {e5c30a1f-bd12-46f2-9eb5-0dfa08e13499} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67704 + + FWP_UINT64 + 10376540038627328000 + + + + {0921d09f-c82d-41d2-814f-6ac23cfb74f5} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67705 + + FWP_UINT64 + 10376540047217262592 + + + + {31d9ed8a-a509-4a04-a9fc-c09be2ae87af} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67706 + + FWP_UINT64 + 10376540038627328000 + + + + {78a6c883-2926-4fa7-82ed-335f51c3b5bd} + + Delivery Optimization (TCP-In) + Inbound rule to allow Delivery Optimization to connect to remote endpoints + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7680 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67707 + + FWP_UINT64 + 10376540047217262592 + + + + {076c0bad-60b8-4a49-a4ce-83bdc9a879f0} + + Core Networking - Router Solicitation (ICMPv6-In) + Router Solicitation messages are sent by nodes seeking routers to provide stateless auto-configuration. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67708 + + FWP_UINT64 + 10376539969505198080 + + + + {45791038-5827-4a2e-993b-7ebfdccffa6a} + + Wireless Display Infrastructure Back Channel (TCP-In) + Inbound rule for Wireless Display Infrastructure back channel [TCP] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000 + \device\harddiskvolume3\windows\system32\castsrv.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7250 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67712 + + FWP_UINT64 + 10376539969505198080 + + + + {0f24cc1b-3e3d-44e1-90a0-f20ac3e4462e} + + Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) + Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67713 + + FWP_UINT64 + 10376539969505198080 + + + + {52dc6841-c31e-4d63-bc57-4e0e2b9b9671} + + Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) + Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67714 + + FWP_UINT64 + 10376539969907851264 + + + + {42f19b9f-5956-45b5-a51c-5b5267d5005a} + + Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) + Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67715 + + FWP_UINT64 + 10376539978497785856 + + + + {2d1be467-dab7-4309-89bc-0e16efbeb1e7} + + Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) + Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67716 + + FWP_UINT64 + 10376539969907851264 + + + + {c094b7da-b5e2-4cac-bf03-d3f8dd685948} + + Core Networking - Neighbour Discovery Advertisement (ICMPv6-In) + Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67717 + + FWP_UINT64 + 10376539978497785856 + + + + {4aee5ef2-93d5-46e6-bee0-725d8e4cdc07} + + Core Networking - Parameter Problem (ICMPv6-In) + Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67730 + + FWP_UINT64 + 10376539969505198080 + + + + {4887adbb-3a7a-48f0-a6b1-9243969c1d1c} + + Core Networking - Parameter Problem (ICMPv6-In) + Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67731 + + FWP_UINT64 + 10376539969907851264 + + + + {56a02554-23d2-4984-95a9-2f461cc4fa66} + + Core Networking - Parameter Problem (ICMPv6-In) + Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67732 + + FWP_UINT64 + 10376539978497785856 + + + + {13668b24-1745-4eef-8097-a78f1683cf37} + + Core Networking - Parameter Problem (ICMPv6-In) + Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67733 + + FWP_UINT64 + 10376539969907851264 + + + + {d9f3965a-d5ba-402c-be4b-fd46d258c1e8} + + Core Networking - Parameter Problem (ICMPv6-In) + Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 4 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67734 + + FWP_UINT64 + 10376539978497785856 + + + + {630130e6-d0ee-4f95-917f-727386eef3d2} + + Core Networking - Packet Too Big (ICMPv6-In) + Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 2 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67735 + + FWP_UINT64 + 10376539969505198080 + + + + {24a965e8-7b7e-4248-b6fa-b4f93990c49a} + + Core Networking - Packet Too Big (ICMPv6-In) + Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 2 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67736 + + FWP_UINT64 + 10376539969907851264 + + + + {1f160125-9b36-460c-a743-a7e17c45ed4f} + + Core Networking - Packet Too Big (ICMPv6-In) + Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 2 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67737 + + FWP_UINT64 + 10376539978497785856 + + + + {5cdc61d6-8697-400d-91c3-ff55d00ff9a9} + + Core Networking - Packet Too Big (ICMPv6-In) + Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 2 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67738 + + FWP_UINT64 + 10376539969907851264 + + + + {412c57e1-2038-40cf-a4eb-1006cc161782} + + Core Networking - Packet Too Big (ICMPv6-In) + Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + a900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 2 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67739 + + FWP_UINT64 + 10376539978497785856 + + + + {33ea4c7f-33e0-4ebc-934e-5c4d8c6bb21e} + + Core Networking - Destination Unreachable (ICMPv6-In) + Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ab00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67742 + + FWP_UINT64 + 10376539969505198080 + + + + {5c2001c6-fed1-458f-a2e5-f05059ba33b3} + + Core Networking - Destination Unreachable (ICMPv6-In) + Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ab00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67743 + + FWP_UINT64 + 10376539969907851264 + + + + {11917a18-01cd-4f40-94a2-c11700ffd140} + + Core Networking - Destination Unreachable (ICMPv6-In) + Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ab00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67744 + + FWP_UINT64 + 10376539978497785856 + + + + {65a7e69a-8dda-48bf-8f7f-77f85ef66d4d} + + Core Networking - Destination Unreachable (ICMPv6-In) + Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ab00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67745 + + FWP_UINT64 + 10376539969907851264 + + + + {0c139d5c-00c0-40fe-a291-119da3eb65a1} + + Core Networking - Destination Unreachable (ICMPv6-In) + Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ab00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67746 + + FWP_UINT64 + 10376539978497785856 + + + + {d91c02d3-8acf-4ca8-b00e-c70abeb4e4f4} + + Core Networking - Internet Group Management Protocol (IGMP-In) + IGMP messages are sent and received by nodes to create, join and depart multicast groups. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ac00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 2 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67748 + + FWP_UINT64 + 10376504785133109248 + + + + {8e67bf87-b3ab-4faa-966d-0374819472f1} + + Core Networking - Time Exceeded (ICMPv6-In) + Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67761 + + FWP_UINT64 + 10376539969505198080 + + + + {03d3765e-5cbb-482f-92e2-b1c2813d43a0} + + Core Networking - Time Exceeded (ICMPv6-In) + Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67762 + + FWP_UINT64 + 10376539969907851264 + + + + {7e3d00b3-7372-4d01-9d99-0ad72294a64e} + + Core Networking - Time Exceeded (ICMPv6-In) + Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67763 + + FWP_UINT64 + 10376539978497785856 + + + + {f4ad030a-de57-4da0-aae8-34007c10742c} + + Core Networking - Time Exceeded (ICMPv6-In) + Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67764 + + FWP_UINT64 + 10376539969907851264 + + + + {db8b7e5e-dfe4-4a20-9ce2-94970713653f} + + Core Networking - Time Exceeded (ICMPv6-In) + Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 3 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67765 + + FWP_UINT64 + 10376539978497785856 + + + + {6fe6052c-9f1b-449f-80e6-1933bd00c2bd} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67779 + + FWP_UINT64 + 10376293747620052992 + + + + {25113d41-4bfd-4f42-b8ed-0782825d5cef} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67780 + + FWP_UINT64 + 10376293748022706176 + + + + {e33d2046-cd76-4858-82c6-4604a02f215f} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67781 + + FWP_UINT64 + 10376293756612640768 + + + + {c67dd978-8cee-43a5-b7c5-7394d13639dd} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67782 + + FWP_UINT64 + 10376293748022706176 + + + + {577f1fbd-6697-4374-831d-ab4957b5d82a} + + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName} + @{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67783 + + FWP_UINT64 + 10376293756612640768 + + + + {497778bf-d906-447e-97c6-3d90e01faf13} + + XING + XING + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67791 + + FWP_UINT64 + 10376293747620052992 + + + + {fa37a31f-edf8-45f1-a12a-3979b049b980} + + XING + XING + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67792 + + FWP_UINT64 + 10376293748022706176 + + + + {7348c729-bea7-4ce3-9126-91bacbf060ab} + + XING + XING + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67793 + + FWP_UINT64 + 10376293756612640768 + + + + {245b69e4-1a3a-4fe8-9121-f716a7758498} + + XING + XING + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67794 + + FWP_UINT64 + 10376293748022706176 + + + + {06682e90-222d-41d9-a82a-c80c77bd5d24} + + XING + XING + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67795 + + FWP_UINT64 + 10376293756612640768 + + + + {f8fe4921-4cac-4e53-9a94-6f3ba592041f} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67803 + + FWP_UINT64 + 10376293747620052992 + + + + {54e08d95-dd62-45d7-89d8-aaa4b6ef259b} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67804 + + FWP_UINT64 + 10376293748022706176 + + + + {219df051-7115-4bae-844c-ff5b93b401c5} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67805 + + FWP_UINT64 + 10376293756612640768 + + + + {bfec4abb-9fae-4382-9946-0f22c6cc800a} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67806 + + FWP_UINT64 + 10376293748022706176 + + + + {7951db55-918d-43fc-b66a-21a5f9c754e5} + + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName} + @{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67807 + + FWP_UINT64 + 10376293756612640768 + + + + {2743ed06-9818-463f-8aa4-b97a298ee1e3} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67815 + + FWP_UINT64 + 10376293747620052992 + + + + {6e4a1c0a-729d-431d-9f8d-0a1df4f16f2f} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67816 + + FWP_UINT64 + 10376293748022706176 + + + + {173e4b5d-3445-413c-a0a6-f1900681f228} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67817 + + FWP_UINT64 + 10376293756612640768 + + + + {f5f65248-7c4f-4a2a-bf44-ef3d8385796f} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67818 + + FWP_UINT64 + 10376293748022706176 + + + + {95150dd6-5f6b-4d72-a721-bd90f0f3e1e3} + + Xbox Game Bar + Xbox Game Bar + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67819 + + FWP_UINT64 + 10376293756612640768 + + + + {5e458804-9d6b-4374-aeb0-0fab8ebfa394} + + Microsoft Teams + Microsoft Teams + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 + \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67823 + + FWP_UINT64 + 10376504785133109248 + + + + {f767a292-c59e-40a5-a090-99dbd8574026} + + Microsoft Teams + Microsoft Teams + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000 + \device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67827 + + FWP_UINT64 + 10376504785133109248 + + + + {5c28dd7c-af06-4a4c-876c-0dc6ab29ee70} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67835 + + FWP_UINT64 + 10376293747620052992 + + + + {559be0e2-e31c-4860-b8f4-f535b5f067ba} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67836 + + FWP_UINT64 + 10376293748022706176 + + + + {16aba0dc-3359-47fe-acf5-496ac83cbaa8} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67837 + + FWP_UINT64 + 10376293756612640768 + + + + {54f2e6d9-ec87-40ef-91a5-e48f51fbce78} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67838 + + FWP_UINT64 + 10376293748022706176 + + + + {c176404f-b6b6-470b-b3be-7c5db41a3c08} + + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + @{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName} + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + b900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67839 + + FWP_UINT64 + 10376293756612640768 + + + + {0bfafb37-da2b-4b57-96c4-dd5e14ef9b9b} + + Cortana + Cortana + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 67847 + + FWP_UINT64 + 10376293747620052992 + + + + {2756a9a2-8940-469d-b0e4-d093e24b8737} + + Cortana + Cortana + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67848 + + FWP_UINT64 + 10376293748022706176 + + + + {0b19d824-b94d-4b8c-8eb0-fb82a74f4c5b} + + Cortana + Cortana + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67849 + + FWP_UINT64 + 10376293756612640768 + + + + {ee6e661b-040e-43b2-9443-46047eaf059e} + + Cortana + Cortana + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67850 + + FWP_UINT64 + 10376293748022706176 + + + + {42de4209-2a60-449b-81c9-feda0c9914be} + + Cortana + Cortana + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + ba00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67851 + + FWP_UINT64 + 10376293756612640768 + + + + {c808a57d-2fb7-4e7d-a772-5667a9bdbc70} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + bb00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67855 + + FWP_UINT64 + 10376539969505198080 + + + + {639e9c00-79c8-4dfb-a3f1-dd6713b27868} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + bd00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67871 + + FWP_UINT64 + 10376539969505198080 + + + + {1256e94d-6137-4f0d-b73a-f8f9ccb8d64a} + + Microsoft Edge (mDNS-In) + Inbound rule for Microsoft Edge to allow mDNS traffic. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + be00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000 + \device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67875 + + FWP_UINT64 + 10376539969505198080 + + + + {5eb6cad8-1d8a-4c51-b026-807f3e3d92e0} + + Allow inbound UDP traffic to CDPSvc port 5050 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c200000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5050 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67879 + + FWP_UINT64 + 246496763052032 + + + + {211c67b6-5dec-468d-9bf9-564f606ad8be} + + Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5160 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67889 + + FWP_UINT64 + 246496763052032 + + + + {d9f11c8c-075e-4271-8012-655bb3f9dde1} + + Allow inbound TCP traffic to CDPSvc from any port to port 5040 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5040 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67893 + + FWP_UINT64 + 246496763052032 + + + + {42b88eb0-34e6-478f-908b-585607fbe41a} + + Block inbound traffic to omadmclient.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ca00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 + \device\harddiskvolume3\windows\system32\omadmclient.exe + + + + + + FWP_ACTION_BLOCK + + + {a8b55da6-3aba-41f3-b7ba-443233f64fce} + + 67895 + + FWP_UINT64 + 137438953472 + + + + {475d5508-5d3a-46d5-9805-e407589473ec} + + Block inbound traffic to deviceenroller.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + cb00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\deviceenroller.exe + + + + + + FWP_ACTION_BLOCK + + + {c4e61e5c-3e66-4efb-b22b-87f8e56cf9c2} + + 67897 + + FWP_UINT64 + 137438953472 + + + + {f0faf4fb-252e-47b9-af71-f9a81a7a650d} + + Block inbound traffic to dmcertinst.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + d000000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\dmcertinst.exe + + + + + + FWP_ACTION_BLOCK + + + {616fdcf3-1169-46b5-8224-cffc7276af2e} + + 67907 + + FWP_UINT64 + 137438953472 + + + + {62af150d-b92a-423a-ab03-b55021e030ef} + + DhcpFirewallPolicy + DhcpFirewallPolicy + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 68 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 67 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67917 + + FWP_UINT64 + 248420908400640 + + + + {e53b388f-16cd-408e-8e6b-1aa8dfdc1ccc} + + DhcpFirewallPolicy + DhcpFirewallPolicy + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 546 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 547 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67919 + + FWP_UINT64 + 248420908400640 + + + + {388a863a-333e-4270-8ea8-3756df7eb475} + + Allow RPC/TCP traffic to EventLog + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67925 + + FWP_UINT64 + 211316685930496 + + + + {ac41a204-b76a-46b4-b943-a8c24d3c5336} + + Allow inbound UDP traffic to fdphost port 3702 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + da00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67927 + + FWP_UINT64 + 246496763052032 + + + + {cb0601b2-92ec-40b8-8422-c92875ed2d56} + + Allow inbound UDP traffic to fdphost port 1900 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + dc00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 1900 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67931 + + FWP_UINT64 + 246496763052032 + + + + {8e76e740-04c4-4d35-a298-11f7dc596749} + + Allow inbound TCP traffic to AJRouter + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 9955 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67941 + + FWP_UINT64 + 246496763052032 + + + + {19ed4871-1493-432b-8d8c-0ccc59f25f6d} + + Allow inbound UDP traffic to AJRouter + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e200000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67943 + + FWP_UINT64 + 211312390963200 + + + + {84c3250b-945e-4d9e-821e-09efa2c38757} + + Allow Grouping to receive from port 3587 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3587 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67949 + + FWP_UINT64 + 246496763052032 + + + + {75fe5296-4bc2-4582-a285-7442b870bf8e} + + Allow PNRP to send to port 3540 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3540 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67953 + + FWP_UINT64 + 246496763052032 + + + + {ad422266-d71d-4380-b44a-fb3e2e95868b} + + IPsec Policy Agent service hardening - Remote Management + Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + eb00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67961 + + FWP_UINT64 + 211316685930496 + + + + {19682e8b-d911-49dc-900a-54cef7765f40} + + Block all inbound traffic to SearchFilterHost + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ec00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\searchfilterhost.exe + + + + + + FWP_ACTION_BLOCK + + + {3a5e8a34-82df-4083-a6ed-87ea8ed3507a} + + 67963 + + FWP_UINT64 + 137438953472 + + + + {2be90617-8637-421f-acca-fb35be82a866} + + Block all inbound traffic to SearchProtocolHost + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ef00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\searchprotocolhost.exe + + + + + + FWP_ACTION_BLOCK + + + {c0cedbe2-34f4-4491-bd19-152a55b1b6e0} + + 67969 + + FWP_UINT64 + 137438953472 + + + + {8dba5a64-72a1-4fcd-bf10-7350fdfe0e60} + + Allow inbound UDP traffic to SNMPTRAP service + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f000000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000 + \device\harddiskvolume3\windows\system32\snmptrap.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67971 + + FWP_UINT64 + 211312390963200 + + + + {031039e8-157e-4c49-a1b7-831802af44ea} + + Allow all inbound TCP and RPC to SPPEXTCOMOBJ + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000 + \device\harddiskvolume3\windows\system32\sppextcomobj.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67973 + + FWP_UINT64 + 211312390963200 + + + + {0adc1095-75ad-4dbe-a1ff-a2cfa50c9182} + + TermServiceLOM + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67978 + + FWP_UINT64 + 211312390963200 + + + + {569847e2-c2ad-471a-a0aa-7db6eda39cce} + + TermServiceLOM + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_INSPECTION + FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6 + + {2ea412db-5c9d-4bbd-9af2-4914d2dbfe17} + + 67979 + + FWP_UINT64 + 18446744073709551615 + + + + {aeb06403-14b2-4f11-911c-d2e71406b781} + + Allow incoming RPC traffic to VDS + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000 + \device\harddiskvolume3\windows\system32\vds.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67981 + + FWP_UINT64 + 211316685930496 + + + + {06ec84e9-0aaf-4282-b849-ffe57c1b0d6a} + + Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 389 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67984 + + FWP_UINT64 + 246496763052032 + + + + {e32e6791-5d61-4ba0-a2c7-6b02831e6a45} + + Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 636 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67985 + + FWP_UINT64 + 246496763052032 + + + + {c6c6d63a-882b-4f39-8ceb-36c8f7555219} + + Allow inbound UDP traffic to NTP port 123 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 123 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67989 + + FWP_UINT64 + 246496763052032 + + + + {0c2c073b-bf6b-4c9f-9606-9ce2126c2f50} + + Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000 + \device\harddiskvolume3\windows\system32\wbengine.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67993 + + FWP_UINT64 + 211316685930496 + + + + {7414eaee-1713-4f1a-836e-a33cf8e7f5ee} + + Cast to Device streaming server hardening rules for RTSP + Allow incoming RTSP connections to the Cast to Device streaming server + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0201000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\mdeserver.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 23554 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68017 + + FWP_UINT64 + 246428043575296 + + + + {74e34cf5-b726-4da8-b473-4740ac1dacfe} + + Cast to Device streaming server hardening rules for RTSP + Allow incoming RTSP connections to the Cast to Device streaming server + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0201000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\mdeserver.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 23555 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68018 + + FWP_UINT64 + 246428043575296 + + + + {7e0a5145-d1e5-42f7-9d4e-d4dd9196b7b0} + + Cast to Device streaming server hardening rules for RTSP + Allow incoming RTSP connections to the Cast to Device streaming server + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0201000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\mdeserver.exe + + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 23556 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68019 + + FWP_UINT64 + 246428043575296 + + + + {54d6e8b9-dec2-46f8-a998-91264ad65362} + + Allow incoming TCP to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0301000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68021 + + FWP_UINT64 + 211312390963200 + + + + {80d42d94-a6d0-4a5d-b8c6-20cdeda245cb} + + Windows Media Player Network Sharing Service service hardening - RTSP + Allow incoming RTSP connections to the Windows Media Player Network Sharing Service + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0901000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000 + \device\harddiskvolume3\program files\windows media player\wmpnetwk.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 554 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68042 + + FWP_UINT64 + 246496763052032 + + + + {b4aeacd5-c926-446e-addd-dc86b9979b64} + + Windows Media Player Network Sharing Service service hardening - RTSP + Allow incoming RTSP connections to the Windows Media Player Network Sharing Service + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0901000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000 + \device\harddiskvolume3\program files\windows media player\wmpnetwk.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 8554 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68043 + + FWP_UINT64 + 246496763052032 + + + + {ec51a54f-1281-48b4-9a56-386529896692} + + WSH Default Inbound Block + Blocks all inbound traffic for services who have been network hardened + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3914275374-678031271-1603343729-3906112567-2888048264)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL + + + + + FWP_ACTION_BLOCK + + + {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} + + 68046 + + FWP_UINT64 + 68719476736 + + + + {27d0382a-b7fd-4536-a470-71a5ea27cb99} + + FTP Inspection Filter + This filter enables inspection of FTP. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 1024 + + + FWP_UINT16 + 65535 + + + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e022e} + + 0 + + 68053 + + FWP_UINT64 + 18446744073709551615 + + + + {58fd9e51-dfb2-4b8b-9f4e-fbe76618a080} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68088 + + FWP_UINT64 + 18446744073709551615 + + + + {98b70176-3bcc-4734-b93b-4eaeeeb6a37b} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68089 + + FWP_UINT64 + 18446744073709551615 + + + + {a300f22a-ae94-4b5f-aa5f-33ff9fbbfce7} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68090 + + FWP_UINT64 + 18446744073709551615 + + + + {d90cbaa3-eaf3-4021-a70a-c130bc327519} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68091 + + FWP_UINT64 + 18446744073709551615 + + + + {c364ce80-e89b-489f-b7ab-ba5da061dc31} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68092 + + FWP_UINT64 + 18446744073709551615 + + + + {941565df-dade-42f5-b5cb-ed48e857a508} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68093 + + FWP_UINT64 + 18446744073709551615 + + + + {00ea3695-8388-45b7-9aaf-49947f97dec5} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68094 + + FWP_UINT64 + 18446744073709551615 + + + + {73508c22-0149-461b-b1f2-3cdc929feea1} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68095 + + FWP_UINT64 + 18446744073709551615 + + + + {198ff4f2-5d0a-40bf-b43e-1d4684b11b65} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68096 + + FWP_UINT64 + 18446744073709551615 + + + + {7f8a98cc-cc4b-410d-ad3c-2d0dd1aebe0e} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68097 + + FWP_UINT64 + 18446744073709551615 + + + + {d2e40d8a-cc87-4ad1-b496-bd28937f886e} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68098 + + FWP_UINT64 + 18446744073709551615 + + + + {6c68a273-fac7-4be9-a9d1-fe56ffa5981d} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 135 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68099 + + FWP_UINT64 + 18446744073709551615 + + + + {5f7e61e7-2af6-4f12-9a07-5522f61f4b86} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68100 + + FWP_UINT64 + 18446744073709551615 + + + + {19590b9d-8cbb-42c2-9a7a-ab0775ecd93b} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68101 + + FWP_UINT64 + 18446744073709551615 + + + + {29f7b740-30f9-4972-adc7-cbfa92803082} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68102 + + FWP_UINT64 + 18446744073709551615 + + + + {6dfc4acb-0027-4d5a-b527-f452291ec069} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68103 + + FWP_UINT64 + 18446744073709551615 + + + + {b1e42ad1-a690-42c2-abf2-57ce5aded578} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68104 + + FWP_UINT64 + 18446744073709551615 + + + + {eb76a71a-600b-4489-be24-d5cf94512966} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68105 + + FWP_UINT64 + 18446744073709551615 + + + + {fed10772-760a-4002-a372-699758835bb5} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68106 + + FWP_UINT64 + 18446744073709551615 + + + + {0ce6b8ef-3f7b-44c7-b923-538b5c6f85cf} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68107 + + FWP_UINT64 + 18446744073709551615 + + + + {40e896f7-d6fa-48a0-8d3d-b89e5c480196} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68108 + + FWP_UINT64 + 18446744073709551615 + + + + {7bead13c-ef8a-406c-b796-15424030645a} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68109 + + FWP_UINT64 + 18446744073709551615 + + + + {0ef1dbc6-5f1c-46fa-a4be-7b601943da68} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68110 + + FWP_UINT64 + 18446744073709551615 + + + + {56610786-c7ca-41fc-abce-e661c467a692} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 134 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68111 + + FWP_UINT64 + 18446744073709551615 + + + + {0677b532-ed94-451f-a801-b69c51ae8932} + + InternetClientServer Inbound Default Rule + InternetClientServer Inbound Default Rule + + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 1c01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + :: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 68209 + + FWP_UINT64 + 206158431224 + + + + {1582a99d-c924-4a69-8c31-38c3e811b06e} + + Microsoft Media Foundation Network Source IN [UDP 5004-5009] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 1f01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5000 + + + FWP_UINT16 + 5020 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68218 + + FWP_UINT64 + 10700788216413290496 + + + + {77733464-f8b8-4139-82ce-d711bf56aa0c} + + Microsoft Media Foundation Network Source IN [UDP 5004-5009] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 1f01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 5000 + + + FWP_UINT16 + 5020 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68219 + + FWP_UINT64 + 10700788225003225088 + + + + {b12e5bff-8fa5-42bd-a2d5-9904d7ca9d03} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 554 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68227 + + FWP_UINT64 + 10700799211529568256 + + + + {bb69d143-1985-454a-b089-308e8e8dc13e} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 554 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68228 + + FWP_UINT64 + 10700799220119502848 + + + + {5acc61db-fd65-4cb1-bc32-8ca12e976908} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 8554 + + + FWP_UINT16 + 8558 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68230 + + FWP_UINT64 + 10700792614459801600 + + + + {aab1ec78-7ee4-49d1-98fc-8c3b631ae069} + + Microsoft Media Foundation Network Source IN [TCP 554] + InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2001000000000000 + ....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 8554 + + + FWP_UINT16 + 8558 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68231 + + FWP_UINT64 + 10700792623049736192 + + + + {35a7aaa5-1838-4ae3-817a-69cb1c19cd18} + + Core Networking - Multicast Listener Done (ICMPv6-In) + Multicast Listener Done messages inform local routers that there are no longer any members remaining for a specific multicast address on the subnet. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2101000000000000 + !....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 132 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68232 + + FWP_UINT64 + 10700799142810091520 + + + + {f93ea8eb-52e1-42c1-9ad4-7c36ffb021d6} + + Core Networking - Multicast Listener Done (ICMPv6-In) + Multicast Listener Done messages inform local routers that there are no longer any members remaining for a specific multicast address on the subnet. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2101000000000000 + !....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 132 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68233 + + FWP_UINT64 + 10700799151400026112 + + + + {a06c507e-0e22-4963-8f44-87618653a39c} + + WFD ASP Coordination Protocol (UDP-In) + Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2201000000000000 + "....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68238 + + FWP_UINT64 + 10700801135674916864 + + + + {33989d24-4033-4bd0-b74f-9bcf3d09dbeb} + + WFD ASP Coordination Protocol (UDP-In) + Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2201000000000000 + "....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68239 + + FWP_UINT64 + 10700801144264851456 + + + + {6a14e12f-4cc9-4ba8-8087-ce034ce64aa9} + + Core Networking - Multicast Listener Report v2 (ICMPv6-In) + Multicast Listener Report v2 message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2301000000000000 + #....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 143 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68240 + + FWP_UINT64 + 10700799142810091520 + + + + {b39cb12b-597e-47f5-8e3f-9dd402f046f7} + + Core Networking - Multicast Listener Report v2 (ICMPv6-In) + Multicast Listener Report v2 message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2301000000000000 + #....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 143 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68241 + + FWP_UINT64 + 10700799151400026112 + + + + {58df562c-0db6-447a-9f51-a1a9ca36a7da} + + Core Networking - Multicast Listener Query (ICMPv6-In) + An IPv6 multicast-capable router uses the Multicast Listener Query message to query a link for multicast group membership. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2401000000000000 + $....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 130 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68242 + + FWP_UINT64 + 10700799142810091520 + + + + {422c78ee-d74f-4287-92cb-f7ebd9b13d7f} + + Core Networking - Multicast Listener Query (ICMPv6-In) + An IPv6 multicast-capable router uses the Multicast Listener Query message to query a link for multicast group membership. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2401000000000000 + $....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 130 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68243 + + FWP_UINT64 + 10700799151400026112 + + + + {c86577a4-f769-4666-8ef8-da0d20234c50} + + Core Networking - Multicast Listener Report (ICMPv6-In) + The Multicast Listener Report message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2501000000000000 + %....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 131 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68244 + + FWP_UINT64 + 10700799142810091520 + + + + {7aebe37a-9063-4a41-bfe2-c5f36fc48aa1} + + Core Networking - Multicast Listener Report (ICMPv6-In) + The Multicast Listener Report message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query. + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2501000000000000 + %....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 530079007300740065006d000000 + System + + + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWP_MATCH_EQUAL + + FWP_UINT16 + 131 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68245 + + FWP_UINT64 + 10700799151400026112 + + + + {c60857b2-86f1-4479-ac73-2d5cc8d478cb} + + mDNS (UDP-In) + Inbound rule for mDNS traffic [UDP] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2601000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68250 + + FWP_UINT64 + 10700799211529568256 + + + + {47eea8d3-5188-4143-acdf-202833261322} + + mDNS (UDP-In) + Inbound rule for mDNS traffic [UDP] + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2601000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5353 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68251 + + FWP_UINT64 + 10700799220119502848 + + + + {efc20c2d-6c5a-4e5b-8a34-98b4483999a2} + + Wi-Fi Direct ASP Coordination Protocol (UDP-In) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2701000000000000 + '....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68254 + + FWP_UINT64 + 324507594213294080 + + + + {35413795-c6d4-4215-a986-4f6430c1d790} + + Wi-Fi Direct ASP Coordination Protocol (UDP-In) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2701000000000000 + '....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68255 + + FWP_UINT64 + 324507602803228672 + + + + {d6b96843-703f-4584-bd03-4031d5af55ea} + + Allow incoming WSD to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2901000000000000 + )....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68262 + + FWP_UINT64 + 324505670067945472 + + + + {2cbbf8db-968e-4981-9676-5e84aba688c6} + + Allow incoming WSD to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2901000000000000 + )....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68263 + + FWP_UINT64 + 324505678657880064 + + + + {ab7af7b8-34b2-47a2-bb0d-cfac2a1a824e} + + Allow incoming WSD to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2a01000000000000 + *....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68266 + + FWP_UINT64 + 324472409841205248 + + + + {15f2650a-c099-4d56-a815-a14736393443} + + Allow incoming WSD to PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2a01000000000000 + *....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68267 + + FWP_UINT64 + 324472418431139840 + + + + {69bf11f7-0703-41a2-933f-5699bf1ebbb4} + + Microsoft Store + Microsoft Store + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + + FWP_ACTION_PERMIT + + + 0 + + 68291 + + FWP_UINT64 + 10376293747620052992 + + + + {436b36f0-9320-423f-a04f-1a9ca00007fb} + + Microsoft Store + Microsoft Store + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68292 + + FWP_UINT64 + 10376293748022706176 + + + + {00117075-341a-482a-acc5-e8b238826759} + + Microsoft Store + Microsoft Store + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68293 + + FWP_UINT64 + 10376293756612640768 + + + + {c5399251-8bef-439b-8544-8f21ffa7ba41} + + Microsoft Store + Microsoft Store + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68294 + + FWP_UINT64 + 10376293748022706176 + + + + {82915472-9da4-48af-b908-8c7a02f6ddaf} + + Microsoft Store + Microsoft Store + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WF + + 2d01000000000000 + -....... + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 + FWPM_SUBLAYER_TEREDO + + FWP_UINT8 + 9 + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_EQUAL + + FWP_SID + S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833) + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68295 + + FWP_UINT64 + 10376293756612640768 + + + + + + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD + + ALE Receive/Accept v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_NAP_CONTEXT + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_REAUTHORIZE_REASON + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 47 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e012f} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD + 279 + + + + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + + ALE Connect v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_REAUTHORIZE_REASON + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_PEER_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_EFFECTIVE_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 48 + + + + FWPM_CALLOUT_IPSEC_ALE_CONNECT_V4 + + WFP Built-in IPsec ALE Connect v4 Layer Callout + Applies IPsec policy modifiers to client applications. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + 15 + + + FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V4 + + WFP Built-in TCP Chimney Offload ALE Connect v4 Layer Callout + Enables or disables TCP Chimney Offload for each outgoing connection. + + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + 19 + + + FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V4 + + WFP Built-in Set Option ALE Connect v4 Layer Callout + Sets classify options on outbound flows. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + 23 + + + FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V4 + + WFP Built-in TCP Templates ALE Connect v4 Layer Callout + Applies TCP Template for each outgoing connection. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + 33 + + + FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4 + + WFP Built-in Reserved callout + WFP Built-in Reserved callout + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + 37 + + + FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_CONNECT_LAYER_V4 + + WFP Built-in Policy Silent Mode ALE Connect v4 Layer Callout + Audit and log policy for outgoing connection. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + 41 + + + FWPM_CALLOUT_BUILT_IN_RESERVED_3 + + WFP Built-in Accept Redirect Proxy Tag ALE Connect v4 Layer Callout + Tags the outgoing connection from an accept redirected proxy app to prevent infinite redirection. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + 47 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0230} + + Windows Firewall: callout + Allows secondary connections. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + 282 + + + + + {b6b2ca61-fb98-4422-adc2-e7cf56b3680c} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66222 + + FWP_UINT64 + 18446744073709551615 + + + + {082edf36-12d7-4698-858a-cf274b78d09a} + + Quarantine Default Inbound Loopback Exception + This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66601 + + FWP_UINT64 + 18446744073709551615 + + + + {304a339a-845d-47b1-9ad9-df3b55c31f26} + + AppContainerLoopback + This filter allows outbound AppContainer loopback traffic + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67196 + + FWP_UINT64 + 18446744073709551615 + + + + {a167c347-5706-417d-ab3f-dc24cdd9c69b} + + AppContainerLoopback + This filter blocks loopback traffic to port 137 + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 137 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_BLOCK + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67198 + + FWP_UINT64 + 18446744073709551615 + + + + {6b9edc4a-2d53-465e-8c54-13b65024e3b6} + + AppContainerLoopback + This filter blocks AppContainer loopback traffic + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551614 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_BLOCK + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67202 + + FWP_UINT64 + 18446744073709551614 + + + + {0a023b5d-ef1a-45a7-9cde-efcb260348a6} + + Default Outbound + This is the default outbound filter which blocks or permits traffic based on user configured default settings + + + FWPM_PROVIDER_MPSSVC_WF + + 9500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67644 + + FWP_UINT64 + 9223372036854777848 + + + + {3bcbc8e4-3be2-43d5-8c7e-765d0de1b129} + + Default Outbound + This is the default outbound filter which blocks or permits traffic based on user configured default settings + + + FWPM_PROVIDER_MPSSVC_WF + + 9500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWP_ACTION_PERMIT + + + 0 + + 67648 + + FWP_UINT64 + 3458764513820540928 + + + + {f7a47614-e0ec-4d6a-9cf2-99b8f993d1b7} + + UWP Default Outbound Block Rule + This is the UWP Default Outbound Block filter. This filter blocks any outbound packets from UWP apps that do not have the correct capability tokens for the resource they are trying to reach. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 9a00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + {11ec8831-cda4-4bab-aa69-cb45e32f4ea9} + + 67659 + + FWP_UINT64 + 137438953472 + + + + {81fe2467-61a3-46dc-8c59-a6a3277920ff} + + AxInstSV TCP outbound allow + Allow only outbound TCP traffic from AxInstSV + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67876 + + FWP_UINT64 + 985368576917504 + + + + {8b7fd125-5491-4c7a-96cb-10aacbccc7d9} + + Allow outbound TCP traffic from CDPSvc from any port to port 5040 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5040 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67880 + + FWP_UINT64 + 987292722266112 + + + + {1ce149fd-f072-4c78-998c-aa9be7b13469} + + Allow outbound UDP traffic from any port to CDPSvc port 5050 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5050 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67882 + + FWP_UINT64 + 987292722266112 + + + + {71a8a4a8-65c6-4a5b-9d97-f15febdc067a} + + Allow outbound UDP traffic from CDPSvc port 5050 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5050 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67884 + + FWP_UINT64 + 1055737321095168 + + + + {2c84d584-7bc5-40db-b6c8-b28d4e40a483} + + Allow outbound TCP traffic from CDPSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67886 + + FWP_UINT64 + 985368576917504 + + + + {672ccb84-0882-4542-8404-7650c867a918} + + Allow outbound TCP traffic from CDPSvc from any port to port 5160 (Wi-Fi Direct Transport) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5160 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67890 + + FWP_UINT64 + 987292722266112 + + + + {185c4b7a-6d3f-46ab-9a41-146c6ec220be} + + Block outbound traffic from deviceenroller.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + cc00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\deviceenroller.exe + + + + + + FWP_ACTION_BLOCK + + + {4dd4109f-8980-4e66-b307-887227d761a4} + + 67898 + + FWP_UINT64 + 137438953472 + + + + {b832287d-98a4-4509-9edf-e796cf1a363f} + + Allow outbound TCP traffic from deviceenroller.exe + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + cd00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\deviceenroller.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67900 + + FWP_UINT64 + 985299857440768 + + + + {7d008627-122e-4757-94f3-40fd1e6a32ab} + + Block outbound traffic from omadmclient.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ce00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 + \device\harddiskvolume3\windows\system32\omadmclient.exe + + + + + + FWP_ACTION_BLOCK + + + {f876928c-1566-4b9a-a110-57d531115565} + + 67902 + + FWP_UINT64 + 137438953472 + + + + {4d0e90b1-9d99-4847-afad-63b5336d414a} + + Allow outbound TCP traffic from omadmclient.exe + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + cf00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 + \device\harddiskvolume3\windows\system32\omadmclient.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67904 + + FWP_UINT64 + 985299857440768 + + + + {af29eee0-e0d3-4834-8d51-668e799215c9} + + Block outbound traffic from dmcertinst.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + d100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\dmcertinst.exe + + + + + + FWP_ACTION_BLOCK + + + {3742db91-517a-4f69-b378-08c5c09364b3} + + 67908 + + FWP_UINT64 + 137438953472 + + + + {4fdcd4c6-c326-4b60-b320-84fc25c10cec} + + Allow outbound TCP traffic from dmcertinst.exe + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d200000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\dmcertinst.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67910 + + FWP_UINT64 + 985299857440768 + + + + {a93ec3cd-e423-4bd5-a38d-3593f40c2fe6} + + Allow outbound TCP traffic from DMEnrollment + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67912 + + FWP_UINT64 + 985368576917504 + + + + {c830f042-5e91-4521-9d1a-c08aeac73a48} + + DhcpFirewallPolicy + DhcpFirewallPolicy + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 68 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 67 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67914 + + FWP_UINT64 + 1057661466443776 + + + + {bd69a0ac-3eec-43c2-8e77-57159930f77f} + + DhcpFirewallPolicy + DhcpFirewallPolicy + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 546 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 547 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67920 + + FWP_UINT64 + 1057661466443776 + + + + {e9f93da5-9659-46c5-9525-93d80021b23f} + + Device Metadata Retrieval + Allow dmrc communication with WMIS + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-286057374-2594772386-1471686342-3682429118-820474675) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 80 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67922 + + FWP_UINT64 + 987292722266112 + + + + {180cd47b-5d74-4505-a1ff-cd84de1d2af5} + + Allow outbound UDP traffic from fdphost port 3702 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + db00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67928 + + FWP_UINT64 + 987292722266112 + + + + {8e168718-b7a5-4ae5-80ee-67e629a24d19} + + Allow outbound UDP traffic from fdphost port 1900 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + dd00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 1900 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67932 + + FWP_UINT64 + 987292722266112 + + + + {b0589e60-9f9a-43aa-9d6b-5f8d52dafd90} + + Allow outbound TCP traffic from fdphost + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + de00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67934 + + FWP_UINT64 + 985368576917504 + + + + {04419b91-af39-4843-9b6a-7676f52111a6} + + Allow outbound UDP traffic to LMHosts port 53 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + df00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 53 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67936 + + FWP_UINT64 + 987292722266112 + + + + {5ba31685-5a93-4ec1-8559-7e4dc41cd4a0} + + Allow outbound TCP traffic to LMHosts port 53 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e000000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 53 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67938 + + FWP_UINT64 + 987292722266112 + + + + {03d2ca8b-de9c-4271-9379-2c7e01346d1d} + + Allow outbound TCP traffic from AJRouter + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67944 + + FWP_UINT64 + 985368576917504 + + + + {beec7dba-4e91-4b23-a7b7-4b946d7b0a03} + + Allow outbound UDP traffic from AJRouter + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67946 + + FWP_UINT64 + 985368576917504 + + + + {0f4eb248-1eb1-44e8-af26-3139fc422409} + + Allow Grouping to send to port 3587 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3587 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67950 + + FWP_UINT64 + 987292722266112 + + + + {8b18ea82-9285-46f1-9d5c-8825be7defbb} + + Allow PNRP to send to port 3540 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3540 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 1024 + + + FWP_UINT16 + 65535 + + + + + + + FWP_ACTION_PERMIT + + + 0 + + 67954 + + FWP_UINT64 + 1056012199002112 + + + + {48f7051b-b0ca-4b0d-b025-7331aa9463cc} + + IPsec Policy Agent service hardening - LDAP/TCP + Allow IPsec Policy Agent outbound LDAP/TCP traffic to Active Directory + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 389 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67956 + + FWP_UINT64 + 987292722266112 + + + + {2b4cfcf1-3509-4705-ab10-1385dd1b35e3} + + IPsec Policy Agent service hardening - LDAP/UDP + Allow IPsec Policy Agent outbound LDAP/UDP traffic to Active Directory + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + ea00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 389 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67958 + + FWP_UINT64 + 987292722266112 + + + + {58ee92c1-2cae-43e7-ab8a-b4063a731c8a} + + Block all outbound traffic from SearchFilterHost + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ed00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\searchfilterhost.exe + + + + + + FWP_ACTION_BLOCK + + + {03843031-9e01-449d-b94b-047c6fbe714c} + + 67964 + + FWP_UINT64 + 137438953472 + + + + {59fe49fe-991b-4b1c-bba1-70fef8bbd4c6} + + Allow outbound LDAP traffic from SearchIndexer + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + ee00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006500610072006300680069006e00640065007800650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\searchindexer.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 389 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67966 + + FWP_UINT64 + 987292722266112 + + + + {0391cc05-7e9f-4eef-be8f-7ba037e44a34} + + Allow all outbound TCP and RPC from SPPEXTCOMOBJ + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f200000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000 + \device\harddiskvolume3\windows\system32\sppextcomobj.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67974 + + FWP_UINT64 + 985368576917504 + + + + {2d002771-07b6-494c-abea-3ab1a1b89169} + + Allow all outbound TCP ports traffic for vmicheartbeat + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 1 + + + FWP_UINT16 + 65535 + + + + + + + FWP_ACTION_PERMIT + + + 0 + + 67986 + + FWP_UINT64 + 985643454824448 + + + + {79d5cc16-49fc-4996-b3a5-2f02a2d79e01} + + Allow outbound UDP traffic from local NTP port 123 to remote NTP port 123 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 123 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 123 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67990 + + FWP_UINT64 + 1057661466443776 + + + + {06fc5b6e-ce4e-4355-ae4f-5b3a5c4ccf25} + + Allow TCP traffic from Wcmsvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + fa00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67994 + + FWP_UINT64 + 985368576917504 + + + + {0f6315c7-96ec-4ed5-9553-6c3ba0363148} + + Allow NTP traffic from Wcmsvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + fb00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 123 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67996 + + FWP_UINT64 + 987292722266112 + + + + {13f46409-d68e-488e-ad18-7f4fb2fe2b64} + + Allow Out TCP traffic from WinDefend + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + fc00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f0077007300200064006500660065006e006400650072005c006d0073006d00700065006e0067002e006500780065000000 + \device\harddiskvolume3\program files\windows defender\msmpeng.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67998 + + FWP_UINT64 + 985368576917504 + + + + {aef21544-e454-4d2f-a571-e803b3a9e120} + + Allow outbound TCP traffic from WinHttpAutoProxySvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + fd00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68000 + + FWP_UINT64 + 985368576917504 + + + + {8915b586-51f3-4e71-9282-cff4dbeca20c} + + Allow TCP traffic from lpasvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0001000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68010 + + FWP_UINT64 + 985368576917504 + + + + {ee4f6b00-cba1-40d4-8d89-0310b8975f30} + + Allow HTTP traffic from cloudidsvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0101000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 443 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68012 + + FWP_UINT64 + 987292722266112 + + + + {ca791cd5-85a3-4b7f-8b6b-9d9cb02ac722} + + Allow outgoing TCP from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0401000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68022 + + FWP_UINT64 + 985368576917504 + + + + {4c5f7c67-c7ce-4313-a45b-70f03fbad5fc} + + WinDefend Outbound for TCP + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0a01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310038002e0032003200300031002e00310030002d0030005c006d0073006d00700065006e0067002e006500780065000000 + \device\harddiskvolume3\programdata\microsoft\windows defender\platform\4.18.2201.10-0\msmpeng.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68044 + + FWP_UINT64 + 985368576917504 + + + + {d07a9c84-a50f-40c9-80f5-303ab4951d68} + + WSH Default Outbound Block + Blocks all outbound traffic for services who have been network hardened + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-2627155378-1124895651-3977206752-2157268346-3811978089)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL + + + + + FWP_ACTION_BLOCK + + + {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} + + 68049 + + FWP_UINT64 + 68719476736 + + + + {e4639f53-f9fd-4949-aec7-e3eefd4e43b4} + + FTP Inspection Filter + This filter enables inspection of FTP. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 1024 + + + FWP_UINT16 + 65535 + + + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0230} + + 0 + + 68054 + + FWP_UINT64 + 18446744073709551615 + + + + {44a498f6-139a-41f2-8d9b-a4ec3885601a} + + InternetClientServer Outbound Default Rule + InternetClientServer Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 1d01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 0.0.0.0 + + + FWP_UINT32 + 255.255.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 68210 + + FWP_UINT64 + 206158432248 + + + + {4c0965e1-a644-4286-b045-9dd0db4c0ac6} + + InternetClient Default Rule + InternetClient Default Rule + + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 1e01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 0.0.0.0 + + + FWP_UINT32 + 255.255.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 68212 + + FWP_UINT64 + 206158432248 + + + + {c70ec623-3900-4841-b0d8-57ba37b02d03} + + Wi-Fi Direct ASP Coordination Protocol (UDP-Out) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2801000000000000 + (....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68256 + + FWP_UINT64 + 253259241672933376 + + + + {825d479b-33b3-47ee-9667-cddf6646c94a} + + Wi-Fi Direct ASP Coordination Protocol (UDP-Out) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2801000000000000 + (....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68257 + + FWP_UINT64 + 253259276032671744 + + + + {7f29d8b2-c34e-4676-a939-0a56f30f4fb2} + + Allow outgoing WSD from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2b01000000000000 + +....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68268 + + FWP_UINT64 + 253257317527584768 + + + + {71d65205-3137-4c02-a833-96c6b1ee73d8} + + Allow outgoing WSD from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2b01000000000000 + +....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68269 + + FWP_UINT64 + 253257351887323136 + + + + {427a2740-809d-4a32-8a1e-03584c5ca624} + + Allow outgoing WSD from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2c01000000000000 + ,....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68272 + + FWP_UINT64 + 253188872928755712 + + + + {4d84d151-4c1c-40c9-a0e6-d2be2bdb3bf2} + + Allow outgoing WSD from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2c01000000000000 + ,....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 10.0.2.0 + + + FWP_UINT32 + 10.0.2.255 + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 224.0.0.0 + + + FWP_UINT32 + 239.255.255.255 + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68273 + + FWP_UINT64 + 253188907288494080 + + + + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD + + ALE Connect v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_REAUTHORIZE_REASON + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_PEER_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_EFFECTIVE_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 49 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0131} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD + 274 + + + + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + + ALE Connect v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_REAUTHORIZE_REASON + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_PEER_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_EFFECTIVE_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 50 + + + + FWPM_CALLOUT_IPSEC_ALE_CONNECT_V6 + + WFP Built-in IPsec ALE Connect v6 Layer Callout + Applies IPsec policy modifiers to client applications. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + 16 + + + FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V6 + + WFP Built-in TCP Chimney Offload ALE Connect v6 Layer Callout + Enables or disables TCP Chimney Offload for each outgoing connection. + + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + 20 + + + FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V6 + + WFP Built-in Set Option ALE Connect v6 Layer Callout + Sets classify options on outbound flows. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + 24 + + + FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V6 + + WFP Built-in TCP Templates ALE Connect v6 Layer Callout + Applies TCP Template for each outgoing connection. + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + 34 + + + FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V6 + + WFP Built-in Reserved callout + WFP Built-in Reserved callout + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + 38 + + + FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_CONNECT_LAYER_V6 + + WFP Built-in Policy Silent Mode ALE Connect v6 Layer Callout + Audit and log policy for outgoing connection. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + 42 + + + FWPM_CALLOUT_BUILT_IN_RESERVED_4 + + WFP Built-in Accept Redirect Proxy Tag ALE Connect v6 Layer Callout + Tags the outgoing connection from an accept redirected proxy app to prevent infinite redirection. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + 48 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0232} + + Windows Firewall: callout + Allows secondary connections. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + 283 + + + + + {0aa7fff8-919f-453c-928c-28a12122ba38} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + 66223 + + FWP_UINT64 + 18446744073709551615 + + + + {15d327cf-89c3-4032-9ded-774ae6b0b49f} + + Quarantine Default Inbound Loopback Exception + This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change. + + + FWPM_FILTER_FLAG_PERSISTENT + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + 66600 + + FWP_UINT64 + 18446744073709551615 + + + + {2c73ec55-e34c-4ebd-8e2e-6268206bc153} + + AppContainerLoopback + This filter allows outbound AppContainer loopback traffic + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67197 + + FWP_UINT64 + 18446744073709551615 + + + + {d26fbfe7-0a28-45b2-83fd-95b733e1a9fd} + + AppContainerLoopback + This filter blocks loopback traffic to port 137 + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 137 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_BLOCK + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67199 + + FWP_UINT64 + 18446744073709551615 + + + + {c5fbb5ec-e4fc-4aac-810a-4219a166cf1c} + + AppContainerLoopback + This filter blocks AppContainer loopback traffic + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_UINT64 + 18446744073709551614 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_BLOCK + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + 67203 + + FWP_UINT64 + 18446744073709551614 + + + + {8c247d5b-b402-40bb-a35b-a55ec3043f1a} + + Default Outbound + This is the default outbound filter which blocks or permits traffic based on user configured default settings + + + FWPM_PROVIDER_MPSSVC_WF + + 9500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 8 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67646 + + FWP_UINT64 + 9223372036854776824 + + + + {0c22b647-52e8-484c-aaea-f3d7f4d9dc11} + + Default Outbound + This is the default outbound filter which blocks or permits traffic based on user configured default settings + + + FWPM_PROVIDER_MPSSVC_WF + + 9500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT8 + 3 + + + + FWP_ACTION_PERMIT + + + 0 + + 67650 + + FWP_UINT64 + 3458764513820540928 + + + + {3af696f6-6a4c-47bb-b032-e6c4faf8cb88} + + UWP Default Outbound Block Rule + This is the UWP Default Outbound Block filter. This filter blocks any outbound packets from UWP apps that do not have the correct capability tokens for the resource they are trying to reach. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 9a00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + {11ec8831-cda4-4bab-aa69-cb45e32f4ea9} + + 67660 + + FWP_UINT64 + 68719476736 + + + + {091b498c-ac44-4e38-8c3d-f40842f71020} + + AxInstSV TCP outbound allow + Allow only outbound TCP traffic from AxInstSV + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67877 + + FWP_UINT64 + 105656195481600 + + + + {66fc1e24-94a1-4f94-8737-a817f1f93509} + + Allow outbound TCP traffic from CDPSvc from any port to port 5040 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5040 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67881 + + FWP_UINT64 + 106068512342016 + + + + {cab91dde-a33b-4d6d-a373-6f1a085eeee2} + + Allow outbound UDP traffic from any port to CDPSvc port 5050 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5050 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67883 + + FWP_UINT64 + 106068512342016 + + + + {12268eee-a96f-414e-ada7-93a9394ae68b} + + Allow outbound UDP traffic from CDPSvc port 5050 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c500000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5050 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67885 + + FWP_UINT64 + 123248381526016 + + + + {2bea35b9-7546-4ba2-bc6d-a11e73d8837b} + + Allow outbound TCP traffic from CDPSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67887 + + FWP_UINT64 + 105656195481600 + + + + {2a9440fb-0bb0-4ff6-8154-d72d60d909a7} + + Allow outbound TCP traffic from CDPSvc from any port to port 5160 (Wi-Fi Direct Transport) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + c800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 5160 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67891 + + FWP_UINT64 + 106068512342016 + + + + {8f1aa30f-7e4d-48d2-8fdf-35af8b7e5b61} + + Block outbound traffic from deviceenroller.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + cc00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\deviceenroller.exe + + + + + + FWP_ACTION_BLOCK + + + {4dd4109f-8980-4e66-b307-887227d761a4} + + 67899 + + FWP_UINT64 + 68719476736 + + + + {6ce0ad1a-cbde-40c6-b942-6c6e066d8c2a} + + Allow outbound TCP traffic from deviceenroller.exe + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + cd00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\deviceenroller.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67901 + + FWP_UINT64 + 105621835743232 + + + + {f30f70ce-47ff-49f7-ba7c-145a3a153449} + + Block outbound traffic from omadmclient.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ce00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 + \device\harddiskvolume3\windows\system32\omadmclient.exe + + + + + + FWP_ACTION_BLOCK + + + {f876928c-1566-4b9a-a110-57d531115565} + + 67903 + + FWP_UINT64 + 68719476736 + + + + {d44825a1-c9fc-485f-98ce-3dd7eecc4876} + + Allow outbound TCP traffic from omadmclient.exe + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + cf00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000 + \device\harddiskvolume3\windows\system32\omadmclient.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67905 + + FWP_UINT64 + 105621835743232 + + + + {30e3a6fe-4e5f-4560-8c1b-62c80250709a} + + Block outbound traffic from dmcertinst.exe + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + d100000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\dmcertinst.exe + + + + + + FWP_ACTION_BLOCK + + + {3742db91-517a-4f69-b378-08c5c09364b3} + + 67909 + + FWP_UINT64 + 68719476736 + + + + {fd5d3521-ac9a-4868-9645-f41db0a96e6a} + + Allow outbound TCP traffic from dmcertinst.exe + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d200000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\dmcertinst.exe + + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67911 + + FWP_UINT64 + 105621835743232 + + + + {1e6890f9-a50c-4153-a5fc-33c0ba2a1836} + + Allow outbound TCP traffic from DMEnrollment + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67913 + + FWP_UINT64 + 105656195481600 + + + + {0036b900-9ed0-4134-bb44-eea7ec2cedee} + + DhcpFirewallPolicy + DhcpFirewallPolicy + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 68 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 67 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67915 + + FWP_UINT64 + 123660698386432 + + + + {296e7a35-573a-40e4-b4e4-b9b262f32db0} + + DhcpFirewallPolicy + DhcpFirewallPolicy + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d700000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 546 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 547 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67921 + + FWP_UINT64 + 123660698386432 + + + + {166a1317-b522-45a1-80ea-9e19153e6b25} + + Device Metadata Retrieval + Allow dmrc communication with WMIS + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + d800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-286057374-2594772386-1471686342-3682429118-820474675) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 80 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67923 + + FWP_UINT64 + 106068512342016 + + + + {a777788c-4705-40a1-ab2b-5a19760caed9} + + Allow outbound UDP traffic from fdphost port 3702 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + db00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67929 + + FWP_UINT64 + 106068512342016 + + + + {f0c77ee0-11f9-4b1c-a42d-8f616ae354f3} + + Allow outbound UDP traffic from fdphost port 1900 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + dd00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 1900 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67933 + + FWP_UINT64 + 106068512342016 + + + + {69327dfd-e878-4369-929c-e3b6e676fbfd} + + Allow outbound TCP traffic from fdphost + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + de00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67935 + + FWP_UINT64 + 105656195481600 + + + + {626987bd-a33b-47b9-9615-37f568d01d82} + + Allow outbound UDP traffic to LMHosts port 53 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + df00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 53 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67937 + + FWP_UINT64 + 106068512342016 + + + + {c29ccedf-39ff-434c-9a77-dcbf23e65d78} + + Allow outbound TCP traffic to LMHosts port 53 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e000000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 53 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67939 + + FWP_UINT64 + 106068512342016 + + + + {c0781e20-e98e-4edd-8629-83265170d024} + + Allow outbound TCP traffic from AJRouter + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e300000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67945 + + FWP_UINT64 + 105656195481600 + + + + {19a3f689-f230-43bc-a1c6-ea367563c31f} + + Allow outbound UDP traffic from AJRouter + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e400000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67947 + + FWP_UINT64 + 105656195481600 + + + + {eb9eb551-58b9-438d-93e3-5e9bfd3fa4a4} + + Allow Grouping to send to port 3587 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3587 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67951 + + FWP_UINT64 + 106068512342016 + + + + {72db2410-37d0-4a0c-ab90-2f27b91f8fa6} + + Allow PNRP to send to port 3540 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3540 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 1024 + + + FWP_UINT16 + 65535 + + + + + + + FWP_ACTION_PERMIT + + + 0 + + 67955 + + FWP_UINT64 + 123385820479488 + + + + {fc565d30-798d-41ae-9037-248e9c9ce633} + + IPsec Policy Agent service hardening - LDAP/TCP + Allow IPsec Policy Agent outbound LDAP/TCP traffic to Active Directory + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + e900000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 389 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67957 + + FWP_UINT64 + 106068512342016 + + + + {051461c3-1d6e-4214-9e67-820fc2e2d10a} + + IPsec Policy Agent service hardening - LDAP/UDP + Allow IPsec Policy Agent outbound LDAP/UDP traffic to Active Directory + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + ea00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 389 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67959 + + FWP_UINT64 + 106068512342016 + + + + {755391ea-bc1b-4822-907e-1102749cfb38} + + Block all outbound traffic from SearchFilterHost + + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + ed00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\searchfilterhost.exe + + + + + + FWP_ACTION_BLOCK + + + {03843031-9e01-449d-b94b-047c6fbe714c} + + 67965 + + FWP_UINT64 + 68719476736 + + + + {6a06e8ac-2968-42da-8e51-0e4a0d3b92a4} + + Allow outbound LDAP traffic from SearchIndexer + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + ee00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006500610072006300680069006e00640065007800650072002e006500780065000000 + \device\harddiskvolume3\windows\system32\searchindexer.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 389 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67967 + + FWP_UINT64 + 106068512342016 + + + + {25a4c983-4191-4c5a-8895-590d672049e0} + + Allow all outbound TCP and RPC from SPPEXTCOMOBJ + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f200000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000 + \device\harddiskvolume3\windows\system32\sppextcomobj.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67975 + + FWP_UINT64 + 105656195481600 + + + + {4222b1e0-05d8-45ef-b1d6-eda36f16a14f} + + Allow all outbound TCP ports traffic for vmicheartbeat + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f600000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 1 + + + FWP_UINT16 + 65535 + + + + + + + FWP_ACTION_PERMIT + + + 0 + + 67987 + + FWP_UINT64 + 105793634435072 + + + + {1b42b924-8daa-4a22-a438-4ce931610f24} + + Allow outbound UDP traffic from local NTP port 123 to remote NTP port 123 + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + f800000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 123 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 123 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67991 + + FWP_UINT64 + 123660698386432 + + + + {f79665c6-3633-4d7b-9c44-461d448be8be} + + Allow TCP traffic from Wcmsvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + fa00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67995 + + FWP_UINT64 + 105656195481600 + + + + {6b276741-4138-4dd3-8d90-394998728306} + + Allow NTP traffic from Wcmsvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + fb00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 123 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67997 + + FWP_UINT64 + 106068512342016 + + + + {65ad8ec4-5659-493a-998e-f37f54973c02} + + Allow Out TCP traffic from WinDefend + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + fc00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f0077007300200064006500660065006e006400650072005c006d0073006d00700065006e0067002e006500780065000000 + \device\harddiskvolume3\program files\windows defender\msmpeng.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 67999 + + FWP_UINT64 + 105656195481600 + + + + {023dae46-b7c7-40c8-90ca-45c70ba97068} + + Allow outbound TCP traffic from WinHttpAutoProxySvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + fd00000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68001 + + FWP_UINT64 + 105656195481600 + + + + {734e929d-2a7b-45e8-a576-1721a9075413} + + Allow TCP traffic from lpasvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0001000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68011 + + FWP_UINT64 + 105656195481600 + + + + {0999a296-1a9e-40e5-bd28-08bf5f4fa7a6} + + Allow HTTP traffic from cloudidsvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0101000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 443 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68013 + + FWP_UINT64 + 106068512342016 + + + + {d60de164-082e-49f2-8c7f-1fc5f5749f53} + + Allow outgoing TCP from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0401000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68023 + + FWP_UINT64 + 105656195481600 + + + + {c0d7b9ed-5246-4d59-87fc-1d39339b02c4} + + WinDefend Outbound for TCP + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 0a01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310038002e0032003200300031002e00310030002d0030005c006d0073006d00700065006e0067002e006500780065000000 + \device\harddiskvolume3\programdata\microsoft\windows defender\platform\4.18.2201.10-0\msmpeng.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736) + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68045 + + FWP_UINT64 + 105656195481600 + + + + {05baa320-a8d8-40e3-b310-3b7d7c115dac} + + WSH Default Outbound Block + Blocks all outbound traffic for services who have been network hardened + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WSH + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-2627155378-1124895651-3977206752-2157268346-3811978089)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL + + + + + FWP_ACTION_BLOCK + + + {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} + + 68048 + + FWP_UINT64 + 34359738368 + + + + {892a3cae-0c40-4a8a-8aa4-cf539bbed38a} + + FTP Inspection Filter + This filter enables inspection of FTP. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT16 + 1024 + + + FWP_UINT16 + 65535 + + + + + + + FWP_ACTION_CALLOUT_UNKNOWN + {c3dbed20-0bb6-4bf3-828d-96732e1e0232} + + 0 + + 68055 + + FWP_UINT64 + 18446744073709551615 + + + + {8b1704e1-3f4f-4fe2-bc92-0b013dd74bdb} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68112 + + FWP_UINT64 + 18446744073709551615 + + + + {9b3fa2c3-4e42-4c0f-8afb-e9f0d58e9261} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68113 + + FWP_UINT64 + 18446744073709551615 + + + + {4bfd4120-6a07-4b97-81fa-455048c76e4a} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68114 + + FWP_UINT64 + 18446744073709551615 + + + + {fcdc301b-92d9-44bb-b257-88b581b56248} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68115 + + FWP_UINT64 + 18446744073709551615 + + + + {408fb9f7-e31d-4c1a-9056-0660f482826f} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68116 + + FWP_UINT64 + 18446744073709551615 + + + + {b0b78a7e-20d4-45d6-987c-57a5783592fb} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68117 + + FWP_UINT64 + 18446744073709551615 + + + + {2f99501c-4c59-413b-b954-3ff993fdbfae} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68118 + + FWP_UINT64 + 18446744073709551615 + + + + {f8157303-181c-4c8d-b79c-47bfde1aeaf0} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68119 + + FWP_UINT64 + 18446744073709551615 + + + + {b17cc3b4-a615-46f3-b2c6-2687d34fab02} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68120 + + FWP_UINT64 + 18446744073709551615 + + + + {9b7b4e38-e234-44d2-b571-d374e27a4e0b} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68121 + + FWP_UINT64 + 18446744073709551615 + + + + {a1619fd8-02a0-47b7-b5e0-cfa96070a783} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68122 + + FWP_UINT64 + 18446744073709551615 + + + + {c08500c7-668a-4bac-945c-34b70d89be0b} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 136 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68123 + + FWP_UINT64 + 18446744073709551615 + + + + {58083807-89f3-4df3-9a42-0030b4a28be1} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68124 + + FWP_UINT64 + 18446744073709551615 + + + + {cc4f4f68-e749-4deb-9532-8eeecc65fd2e} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68125 + + FWP_UINT64 + 18446744073709551615 + + + + {8c5974d0-a252-4be3-8805-88649820ec32} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68126 + + FWP_UINT64 + 18446744073709551615 + + + + {1a3d3203-0424-42d8-8027-248351309474} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68127 + + FWP_UINT64 + 18446744073709551615 + + + + {0b8840ae-0286-4003-a653-1918f0bb88e6} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68128 + + FWP_UINT64 + 18446744073709551615 + + + + {59c1253f-d019-4d86-9d10-a620dedbf830} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68129 + + FWP_UINT64 + 18446744073709551615 + + + + {75410a3a-fb4b-4c4e-a43b-65fa2f6b12b6} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68130 + + FWP_UINT64 + 18446744073709551615 + + + + {8a3541a0-0456-4909-91bc-a016060fc4ba} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68131 + + FWP_UINT64 + 18446744073709551615 + + + + {bad0a5c5-8e42-4b2e-907d-43d004424df9} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68132 + + FWP_UINT64 + 18446744073709551615 + + + + {85fd608d-794c-47d5-9819-86dddddd6fb6} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 3 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68133 + + FWP_UINT64 + 18446744073709551615 + + + + {f09da621-2d41-44ef-80d0-142da1df005b} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 2 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68134 + + FWP_UINT64 + 18446744073709551615 + + + + {88bbe0f8-8dfc-4699-a847-a9349a4af991} + + Boot Time Filter + This filter is in effect before the service starts. + + + FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT + FWPM_FILTER_FLAG_INDEXED + FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 58 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 133 + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWP_MATCH_EQUAL + + FWP_UINT8 + 3 + + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 131 + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 14 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + + FWP_ACTION_PERMIT + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + 68135 + + FWP_UINT64 + 18446744073709551615 + + + + {429c6993-632c-4633-b930-65684a5b7300} + + InternetClientServer Outbound Default Rule + InternetClientServer Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 1d01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + :: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 68211 + + FWP_UINT64 + 103079216120 + + + + {82e6ae67-453a-49bd-b6e2-7b46d586602a} + + InternetClient Default Rule + InternetClient Default Rule + + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 1e01000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + :: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 68213 + + FWP_UINT64 + 103079216120 + + + + {9a8412a0-0fd5-462c-a11f-eb5ec9fc9709} + + Wi-Fi Direct ASP Coordination Protocol (UDP-Out) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2801000000000000 + (....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68258 + + FWP_UINT64 + 162253247820595200 + + + + {ad448bcc-9e58-4f9d-9d01-844b5628280b} + + Wi-Fi Direct ASP Coordination Protocol (UDP-Out) + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2801000000000000 + (....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 7235 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68259 + + FWP_UINT64 + 162253265000464384 + + + + {ca82888c-e15c-4d97-9deb-f172bcc2c55c} + + Allow outgoing WSD from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2b01000000000000 + +....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68270 + + FWP_UINT64 + 162252835503734784 + + + + {413958f1-052c-41bb-9600-59345c58297d} + + Allow outgoing WSD from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2b01000000000000 + +....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68271 + + FWP_UINT64 + 162252852683603968 + + + + {b5b94431-92bb-4993-ae20-dca728cb6a3f} + + Allow outgoing WSD from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2c01000000000000 + ,....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68274 + + FWP_UINT64 + 162235655634550784 + + + + {f3611be4-ea21-41ad-bfbb-ff12ffc536f9} + + Allow outgoing WSD from PeerDistSvc + + + + FWPM_FILTER_FLAG_INDEXED + + FWPM_PROVIDER_MPSSVC_WSH + + 2c01000000000000 + ,....... + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_APP_ID + FWP_MATCH_EQUAL + + FWP_BYTE_BLOB_TYPE + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000 + \device\harddiskvolume3\windows\system32\svchost.exe + + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329) + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + fe80:: + + + FWP_BYTE_ARRAY16_TYPE + fe80::ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + ff00:: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 3702 + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_ALL_SET + + FWP_UINT32 + 4 + + + + + FWP_ACTION_PERMIT + + + 0 + + 68275 + + FWP_UINT64 + 162235672814419968 + + + + + + + FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD + + ALE Connect v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_ARRIVAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_NEXTHOP_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_REAUTHORIZE_REASON + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_PEER_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ORIGINAL_ICMP_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_EFFECTIVE_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 51 + + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0133} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD + 275 + + + + + + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 + + ALE Flow Established v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 52 + + + + {8e44982b-f477-11df-85ce-78e7d1810190} + + NDU Flow Established V4 Callout + NDU Flow Established V4 Callout + + + FWP_CALLOUT_FLAG_ALLOW_OFFLOAD + FWPM_CALLOUT_FLAG_REGISTERED + 00000360 + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 + 262 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0134} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 + 280 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0334} + + Windows Firewall: callout + Initiates deep protocol inspection on the flow. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 + 286 + + + {f762e452-8bfd-47f6-9425-368d888b01dc} + + windefend_flow_established_v4 + windefend + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 + 298 + + + + + {8e44982c-f477-11df-85ce-78e7d1810190} + + NDU Flow Established V4 SubLayer Filter + NDU Flow Established V4 SubLayer Filter + + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 + FWPM_SUBLAYER_INSPECTION + + FWP_EMPTY + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_CALLOUT_INSPECTION + {8e44982b-f477-11df-85ce-78e7d1810190} + + 0 + + 66999 + + FWP_UINT64 + 2 + + + + {a5ce04ca-2cda-423e-8fef-52fb9e9fcf3a} + + FTP Inspection Filter + This filter enables inspection of FTP. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 21 + + + + + FWP_ACTION_CALLOUT_INSPECTION + {c3dbed20-0bb6-4bf3-828d-96732e1e0334} + + 0 + + 68056 + + FWP_UINT64 + 18446744073709551615 + + + + {a70ef9b7-c790-4db0-a376-0378f9815b02} + + FTP Inspection Filter + This filter enables inspection of FTP. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 21 + + + + + FWP_ACTION_CALLOUT_INSPECTION + {c3dbed20-0bb6-4bf3-828d-96732e1e0334} + + 0 + + 68058 + + FWP_UINT64 + 18446744073709551615 + + + + {a1dd6389-d3b1-4f46-9300-611216024728} + + windefend_flow_established_v4 + windefend + + + + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 + {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} + + FWP_EMPTY + + + + FWPM_CONDITION_DIRECTION + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_DIRECTION + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_INSPECTION + {f762e452-8bfd-47f6-9425-368d888b01dc} + + 0 + + 68280 + + FWP_UINT64 + 532575961056 + + + + + + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD + + ALE Flow Established v4 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 53 + + + + + + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 + + ALE Flow Established v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 54 + + + + {8e44982d-f477-11df-85ce-78e7d1810190} + + NDU Flow Established V6 Callout + NDU Flow Established V6 Callout + + + FWP_CALLOUT_FLAG_ALLOW_OFFLOAD + FWPM_CALLOUT_FLAG_REGISTERED + 00000360 + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 + 263 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0136} + + Windows Firewall: callout + Performs logging. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000200 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 + 281 + + + {c3dbed20-0bb6-4bf3-828d-96732e1e0336} + + Windows Firewall: callout + Initiates deep protocol inspection on the flow. + + + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 + 287 + + + {31114833-2891-4edd-a8ec-2ff8549aa491} + + windefend_flow_established_v6 + windefend + + + FWPM_CALLOUT_FLAG_REGISTERED + + + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 + 299 + + + + + {8e44982e-f477-11df-85ce-78e7d1810190} + + NDU Flow Established V6 SubLayer Filter + NDU Flow Established V6 SubLayer Filter + + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 + FWPM_SUBLAYER_INSPECTION + + FWP_EMPTY + + + + FWPM_CONDITION_FLAGS + FWP_MATCH_FLAGS_NONE_SET + + FWP_UINT32 + 1 + + + + + FWP_ACTION_CALLOUT_INSPECTION + {8e44982d-f477-11df-85ce-78e7d1810190} + + 0 + + 67000 + + FWP_UINT64 + 2 + + + + {8076bfdc-eed9-4602-9570-29b6e402fba5} + + FTP Inspection Filter + This filter enables inspection of FTP. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_REMOTE_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 21 + + + + + FWP_ACTION_CALLOUT_INSPECTION + {c3dbed20-0bb6-4bf3-828d-96732e1e0336} + + 0 + + 68057 + + FWP_UINT64 + 18446744073709551615 + + + + {b6c1c213-7518-4af8-9bcf-eeabe82c63ac} + + FTP Inspection Filter + This filter enables inspection of FTP. + + + FWPM_PROVIDER_MPSSVC_WF + + ffffffffffffffff + ........ + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 + FWPM_SUBLAYER_MPSSVC_WF + + FWP_UINT64 + 18446744073709551615 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_LOCAL_PORT + FWP_MATCH_EQUAL + + FWP_UINT16 + 21 + + + + + FWP_ACTION_CALLOUT_INSPECTION + {c3dbed20-0bb6-4bf3-828d-96732e1e0336} + + 0 + + 68059 + + FWP_UINT64 + 18446744073709551615 + + + + {4994b7fe-47d8-4ac5-8fa8-77b203c5b640} + + windefend_flow_established_v6 + windefend + + + + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 + {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} + + FWP_EMPTY + + + + FWPM_CONDITION_DIRECTION + FWP_MATCH_EQUAL + + FWP_UINT32 + 0 + + + + FWPM_CONDITION_DIRECTION + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 6 + + + + FWPM_CONDITION_IP_PROTOCOL + FWP_MATCH_EQUAL + + FWP_UINT8 + 17 + + + + + FWP_ACTION_CALLOUT_INSPECTION + {31114833-2891-4edd-a8ec-2ff8549aa491} + + 0 + + 68281 + + FWP_UINT64 + 33286004704 + + + + + + + FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD + + ALE Flow Established v6 Discard Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_ALE_REMOTE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_REMOTE_MACHINE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 55 + + + + + + + FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET + + Inbound Ethernet Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_INTERFACE_MAC_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_LOCAL_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_REMOTE_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_ETHER_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VLAN_ID + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NDIS_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 56 + + + + + + + FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET + + Outbound Ethernet Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_INTERFACE_MAC_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_LOCAL_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_REMOTE_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_ETHER_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VLAN_ID + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NDIS_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 57 + + + + + + + FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE + + Inbound Native MAC Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_NDIS_MEDIA_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NDIS_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 58 + + + + + + + FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE + + Outbound Native MAC Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_NDIS_MEDIA_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_NDIS_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 59 + + + + + + + FWPM_LAYER_NAME_RESOLUTION_CACHE_V4 + + Name Resolution Cache v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_PEER_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 60 + + + + + + + FWPM_LAYER_NAME_RESOLUTION_CACHE_V6 + + Name Resolution Cache v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_PEER_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 61 + + + + + + + FWPM_LAYER_ALE_RESOURCE_RELEASE_V4 + + ALE Resource Release v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 62 + + + + + + + FWPM_LAYER_ALE_RESOURCE_RELEASE_V6 + + ALE Resource Release v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 63 + + + + + + + FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 + + ALE Endpoint Closure v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 64 + + + + + + + FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V6 + + ALE Endpoint Closure v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 65 + + + + + + + FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 + + ALE Connect Redirect v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 66 + + + + + + + FWPM_LAYER_ALE_CONNECT_REDIRECT_V6 + + ALE Connect Redirect v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_ORIGINAL_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 67 + + + + + + + FWPM_LAYER_ALE_BIND_REDIRECT_V4 + + ALE Bind Redirect v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 68 + + + + {8bc14e84-4287-4c9e-81da-532335532058} + + Interface Binding Callout + + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + FWPM_PROVIDER_MPSSVC_WSH + + FWPM_LAYER_ALE_BIND_REDIRECT_V4 + 258 + + + + + + + FWPM_LAYER_ALE_BIND_REDIRECT_V6 + + ALE Bind Redirect v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 69 + + + + {8bc14e84-4287-4c9e-81da-532335532059} + + Interface Binding Callout + + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + FWPM_PROVIDER_MPSSVC_WSH + + FWPM_LAYER_ALE_BIND_REDIRECT_V6 + 259 + + + + + + + FWPM_LAYER_STREAM_PACKET_V4 + + Stream Packet v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 70 + + + + + + + FWPM_LAYER_STREAM_PACKET_V6 + + Stream Packet v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SUB_INTERFACE_INDEX + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_TUNNEL_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 71 + + + + + + + FWPM_LAYER_INGRESS_VSWITCH_ETHERNET + + Ingress vSwitch Ethernet layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_MAC_SOURCE_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_MAC_DESTINATION_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_ETHER_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VLAN_ID + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_VSWITCH_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_NETWORK_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_VM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 72 + + + + + + + FWPM_LAYER_EGRESS_VSWITCH_ETHERNET + + Egress vSwitch Ethernet layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_MAC_SOURCE_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_MAC_DESTINATION_ADDRESS + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY6_TYPE + + + FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_ETHER_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VLAN_ID + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_VSWITCH_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_NETWORK_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_VM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 73 + + + + + + + FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V4 + + Ingress vSwitch Transport v4 layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_SOURCE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_SOURCE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_DESTINATION_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VLAN_ID + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_VSWITCH_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_NETWORK_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_VM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 74 + + + + + + + FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V6 + + Ingress vSwitch Transport v6 layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_SOURCE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_SOURCE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_DESTINATION_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VLAN_ID + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_VSWITCH_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_NETWORK_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_VM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 75 + + + + + + + FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V4 + + Egress vSwitch Transport v4 layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_SOURCE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_SOURCE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_DESTINATION_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VLAN_ID + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_VSWITCH_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_NETWORK_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_VM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 76 + + + + + + + FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V6 + + Egress vSwitch Transport v6 layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_SOURCE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_DESTINATION_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_SOURCE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_DESTINATION_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VLAN_ID + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_VSWITCH_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_NETWORK_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_SOURCE_VM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_L2_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 77 + + + + + + + FWPM_LAYER_INBOUND_TRANSPORT_FAST + + Inbound Transport v4 Layer fast + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + FWPM_SUBLAYER_UNIVERSAL + 78 + + + + {8e44982f-f477-11df-85ce-78e7d1810190} + + NDU Inbound Transport Callout + NDU Inbound Transport Callout + + + FWP_CALLOUT_FLAG_ALLOW_OFFLOAD + FWPM_CALLOUT_FLAG_REGISTERED + 00000360 + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_INBOUND_TRANSPORT_FAST + 264 + + + + + {8e449830-f477-11df-85ce-78e7d1810190} + + NDU Inbound Transport SubLayer Filter + NDU Inbound Transport SubLayer Filter + + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_INBOUND_TRANSPORT_FAST + FWPM_SUBLAYER_INSPECTION + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_INSPECTION + {8e44982f-f477-11df-85ce-78e7d1810190} + + 0 + + 67001 + + FWP_UINT64 + 576460752303423487 + + + + + + + FWPM_LAYER_OUTBOUND_TRANSPORT_FAST + + Outbound Transport v4 Layer fast + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + FWPM_SUBLAYER_UNIVERSAL + 79 + + + + {8e449833-f477-11df-85ce-78e7d1810190} + + NDU Outbound Transport Callout + NDU Outbound Transport Callout + + + FWP_CALLOUT_FLAG_ALLOW_OFFLOAD + FWPM_CALLOUT_FLAG_REGISTERED + 00000360 + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_OUTBOUND_TRANSPORT_FAST + 265 + + + + + {8e449834-f477-11df-85ce-78e7d1810190} + + NDU Outbound Transport SubLayer Filter + NDU Outbound Transport SubLayer Filter + + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_OUTBOUND_TRANSPORT_FAST + FWPM_SUBLAYER_INSPECTION + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_INSPECTION + {8e449833-f477-11df-85ce-78e7d1810190} + + 0 + + 67002 + + FWP_UINT64 + 576460752303423487 + + + + + + + FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST + + Inbound Native MAC Layer fast + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + FWPM_SUBLAYER_UNIVERSAL + 80 + + + + {8e449837-f477-11df-85ce-78e7d1810190} + + NDU Inbound Mac Frame Native Callout + NDU Inbound Mac Frame Native Callout + + + FWP_CALLOUT_FLAG_ALLOW_OFFLOAD + FWPM_CALLOUT_FLAG_REGISTERED + 000003E0 + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST + 266 + + + + + {8e449838-f477-11df-85ce-78e7d1810190} + + NDU Inbound Mac Frame Native SubLayer Filter + NDU Inbound Mac Frame Native SubLayer Filter + + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST + FWPM_SUBLAYER_INSPECTION + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_INSPECTION + {8e449837-f477-11df-85ce-78e7d1810190} + + 0 + + 67003 + + FWP_UINT64 + 576460752303423487 + + + + + + + FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST + + Outbound Native MAC Layer fast + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + FWPM_SUBLAYER_UNIVERSAL + 81 + + + + {8e449839-f477-11df-85ce-78e7d1810190} + + NDU Outbound Mac Frame Native Callout + NDU Outbound Mac Frame Native Callout + + + FWP_CALLOUT_FLAG_ALLOW_OFFLOAD + FWPM_CALLOUT_FLAG_REGISTERED + 000003E0 + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST + 267 + + + + + {8e44983a-f477-11df-85ce-78e7d1810190} + + NDU Outbound Mac Frame Native SubLayer Filter + NDU Outbound Mac Frame Native SubLayer Filter + + + {8e44982a-f477-11df-85ce-78e7d1810190} + + FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST + FWPM_SUBLAYER_INSPECTION + + FWP_EMPTY + + + + FWP_ACTION_CALLOUT_INSPECTION + {8e449839-f477-11df-85ce-78e7d1810190} + + 0 + + 67004 + + FWP_UINT64 + 576460752303423487 + + + + + + + FWPM_LAYER_INBOUND_RESERVED2 + + Inbound HTTP Reserved Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_RESERVED0 + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_RESERVED1 + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_RESERVED2 + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_RESERVED3 + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_RESERVED4 + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_RESERVED5 + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_RESERVED6 + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_RESERVED7 + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_RESERVED8 + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_RESERVED9 + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_RESERVED10 + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_RESERVED11 + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_RESERVED12 + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_RESERVED13 + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_RESERVED14 + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_RESERVED15 + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 82 + + + + + + + {29243af8-ecaf-4436-a44e-f9fb7070aa04} + + ALE Accept Redirect v4 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 83 + + + + FWPM_CALLOUT_BUILT_IN_RESERVED_1 + + WFP Built-in Proxy Connection ALE Accept Redirect v4 Layer Callout + Redirects the inbound connection to the address in the provider context. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + {29243af8-ecaf-4436-a44e-f9fb7070aa04} + 45 + + + + + + + {c9809347-218f-4b7f-a742-b281a3f631b4} + + ALE Accept Redirect v6 Layer + + + + FWPM_LAYER_FLAG_KERNEL + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_ALE_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_ALE_USER_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_ACCESS_INFORMATION_TYPE + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWPM_FIELD_RAW_DATA + FWP_SID + + + FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_COMPARTMENT_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 84 + + + + FWPM_CALLOUT_BUILT_IN_RESERVED_2 + + WFP Built-in Proxy Connection ALE Accept Redirect v6 Layer Callout + Redirects the inbound connection to the address in the provider context. + + + FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT + FWPM_CALLOUT_FLAG_REGISTERED + 00000300 + + + + {c9809347-218f-4b7f-a742-b281a3f631b4} + 46 + + + + + + + FWPM_LAYER_IPSEC_KM_DEMUX_V4 + + IPsec KM Demux v4 Layer + + + + FWPM_LAYER_FLAG_BUILTIN + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_QM_MODE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 85 + + + + + + + FWPM_LAYER_IPSEC_KM_DEMUX_V6 + + IPsec KM Demux v6 Layer + + + + FWPM_LAYER_FLAG_BUILTIN + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_QM_MODE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 86 + + + + + + + FWPM_LAYER_IPSEC_V4 + + IPsec v4 Layer + + + + FWPM_LAYER_FLAG_BUILTIN + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 87 + + + + + + + FWPM_LAYER_IPSEC_V6 + + IPsec v6 Layer + + + + FWPM_LAYER_FLAG_BUILTIN + + + + FWPM_CONDITION_IP_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_REMOTE_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 88 + + + + + + + FWPM_LAYER_IKEEXT_V4 + + IKE v4 Layer + + + + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 89 + + + + + + + FWPM_LAYER_IKEEXT_V6 + + IKE v6 Layer + + + + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_IP_LOCAL_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_INTERFACE + FWPM_FIELD_RAW_DATA + FWP_UINT64 + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_SECURITY_REALM_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 90 + + + + + + + FWPM_LAYER_RPC_UM + + RPC UM Layer + + + + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_REMOTE_USER_TOKEN + FWPM_FIELD_RAW_DATA + FWP_TOKEN_INFORMATION_TYPE + + + FWPM_CONDITION_RPC_IF_UUID + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_RPC_IF_VERSION + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_RPC_IF_FLAG + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DCOM_APP_ID + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IMAGE_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_RPC_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_RPC_AUTH_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_RPC_AUTH_LEVEL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SEC_KEY_SIZE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_V4 + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_V6 + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_PIPE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS_V4 + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS_V6 + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 91 + + + + + + + FWPM_LAYER_RPC_EPMAP + + RPC EPMAP Layer + + + + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_REMOTE_USER_TOKEN + FWPM_FIELD_RAW_DATA + FWP_TOKEN_INFORMATION_TYPE + + + FWPM_CONDITION_RPC_IF_UUID + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_RPC_IF_VERSION + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_RPC_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_RPC_AUTH_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_RPC_AUTH_LEVEL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_SEC_KEY_SIZE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_V4 + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_LOCAL_ADDRESS_V6 + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_IP_LOCAL_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_PIPE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_IP_REMOTE_ADDRESS_V4 + FWPM_FIELD_IP_ADDRESS + FWP_UINT32 + + + FWPM_CONDITION_IP_REMOTE_ADDRESS_V6 + FWPM_FIELD_IP_ADDRESS + FWP_BYTE_ARRAY16_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 92 + + + + + + + FWPM_LAYER_RPC_EP_ADD + + RPC EP ADD Layer + + + + FWPM_LAYER_FLAG_BUILTIN + + + + FWPM_CONDITION_PROCESS_WITH_RPC_IF_UUID + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_RPC_PROTOCOL + FWPM_FIELD_RAW_DATA + FWP_UINT8 + + + FWPM_CONDITION_RPC_EP_VALUE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_RPC_EP_FLAGS + FWPM_FIELD_FLAGS + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 93 + + + + + + + FWPM_LAYER_RPC_PROXY_CONN + + RPC Proxy Connect Layer + + + + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_CLIENT_TOKEN + FWPM_FIELD_RAW_DATA + FWP_TOKEN_INFORMATION_TYPE + + + FWPM_CONDITION_RPC_SERVER_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_RPC_SERVER_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_RPC_PROXY_AUTH_TYPE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CLIENT_CERT_OID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 94 + + + + + + + FWPM_LAYER_RPC_PROXY_IF + + RPC Proxy Interface Layer + + + + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_CLIENT_TOKEN + FWPM_FIELD_RAW_DATA + FWP_TOKEN_INFORMATION_TYPE + + + FWPM_CONDITION_RPC_IF_UUID + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_RPC_IF_VERSION + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_RPC_SERVER_NAME + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_RPC_SERVER_PORT + FWPM_FIELD_RAW_DATA + FWP_UINT16 + + + FWPM_CONDITION_RPC_PROXY_AUTH_TYPE + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_CLIENT_CERT_OID + FWPM_FIELD_RAW_DATA + FWP_BYTE_BLOB_TYPE + + + FWPM_SUBLAYER_UNIVERSAL + 95 + + + + + + + FWPM_LAYER_KM_AUTHORIZATION + + Keying Module Authorization Layer + + + + FWPM_LAYER_FLAG_BUILTIN + FWPM_LAYER_FLAG_CLASSIFY_MOSTLY + + + + FWPM_CONDITION_REMOTE_ID + FWPM_FIELD_RAW_DATA + FWP_TOKEN_INFORMATION_TYPE + + + FWPM_CONDITION_AUTHENTICATION_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_KM_TYPE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_DIRECTION + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_KM_MODE + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_CONDITION_IPSEC_POLICY_KEY + FWPM_FIELD_RAW_DATA + FWP_BYTE_ARRAY16_TYPE + + + FWPM_CONDITION_KM_AUTH_NAP_CONTEXT + FWPM_FIELD_RAW_DATA + FWP_UINT32 + + + FWPM_SUBLAYER_UNIVERSAL + 96 + + + + + + + + FWPM_PROVIDER_IKEEXT + + Microsoft Corporation + Microsoft Windows WFP Built-in IKEEXT provider used to identify filters added by IKE/AuthIP. + + + FWPM_PROVIDER_FLAG_DISABLED + + + IKEEXT + + + FWPM_PROVIDER_TCP_CHIMNEY_OFFLOAD + + Microsoft Corporation + Microsoft Windows WFP Built-in TCP Chimney Offload provider used to identify filters added by TCP Chimney Offload. + + + + + + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + @bfe.dll,-1217 + Microsoft Windows WFP Built-in MPSSVC App Isolation provider. + + + + mpssvc + + + FWPM_PROVIDER_MPSSVC_WSH + + Microsoft Corporation + Microsoft Windows WFP Built-in MPSSVC Windows Service Hardening and Quarantine provider. + + + + mpssvc + + + FWPM_PROVIDER_MPSSVC_EDP + + Microsoft Corporation + Microsoft Windows WFP Built-in MPSSVC Enterprise Data Protection provider. + + + + mpssvc + + + {c698301d-9129-450c-937c-f4b834bfb374} + + Microsoft Corporation + Microsoft Windows edge traversal socket option authorization provider + + + + + + + {893a4f22-9bba-49b7-8c66-3d40929c8fd5} + + Microsoft Corporation + Microsoft Windows Teredo firewall provider + + + + + + + FWPM_PROVIDER_MPSSVC_WF + + Microsoft Corporation + Microsoft Windows WFP Built-in MPSSVC Windows Firewall provider. + + + + mpssvc + + + FWPM_PROVIDER_IPSEC_DOSP_CONFIG + + Microsoft Corporation + Microsoft Windows WFP Built-in IPsec DoS Protection configuration provider used to identify filters added by IPsec Denial of Service Protection. + + + + + + + FWPM_PROVIDER_TCP_TEMPLATES + + Microsoft Corporation + Microsoft Windows WFP Built-in TCP Templates provider used to identify filters added by TCP Template based configuration. + + + + + + + FWPM_PROVIDER_MPSSVC_TENANT_RESTRICTIONS + + WFP Built-in MPSSVC Tenant Restrictions Sublayer + Microsoft Windows WFP Built-in MPSSVC Tenant Restrictions provider. + + + + mpssvc + + + {1bebc969-61a5-4732-a177-847a0817862a} + + Microsoft Corporation + Microsoft Windows Defender Firewall IPsec Provider + + + FWPM_PROVIDER_FLAG_PERSISTENT + + + MPSSVC + + + {8e44982a-f477-11df-85ce-78e7d1810190} + + Microsoft Corporation + Windows Network Data Usage (NDU) Provider + + + + NDU + + + + + FWPM_PROVIDER_CONTEXT_SECURE_SOCKET_AUTHIP + + WFP Built-in Default Secure Socket AuthIP Policy Provider Context + Authenticated Internet Protocol (AuthIP) main mode default policy for secure sockets. + + + + + FWPM_IPSEC_AUTHIP_MM_CONTEXT + + 0 + + + IKEEXT_ANONYMOUS + + + IKEEXT_IMPERSONATION_NONE + + + + IKEEXT_CIPHER_AES_128 + 0 + 0 + + + IKEEXT_INTEGRITY_SHA1 + + 7200 + IKEEXT_DH_ECP_256 + 0 + + + + IKEEXT_CIPHER_3DES + 0 + 0 + + + IKEEXT_INTEGRITY_SHA1 + + 7200 + IKEEXT_DH_GROUP_2 + 0 + + + + 0 + 0 + + 9223372036854775808 + + + FWPM_PROVIDER_CONTEXT_SECURE_SOCKET_IPSEC + + WFP Built-in Default Secure Socket IPsec Policy Provider Context + Internet Protocol Security (IPsec) quick mode default policy for secure sockets. + + + + + FWPM_IPSEC_AUTHIP_QM_TRANSPORT_CONTEXT + + + + + 3600 + 56320 + 2147483647 + + + + IPSEC_TRANSFORM_ESP_AUTH + + + IPSEC_AUTH_SHA_1 + IPSEC_AUTH_CONFIG_HMAC_SHA_1_96 + + + + + + IPSEC_PFS_NONE + + + + 3600 + 56320 + 2147483647 + + + + IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER + + + + IPSEC_AUTH_SHA_1 + IPSEC_AUTH_CONFIG_HMAC_SHA_1_96 + + + + + + IPSEC_CIPHER_TYPE_AES_128 + IPSEC_CIPHER_CONFIG_CBC_AES_128 + + + + + + + IPSEC_PFS_NONE + + + + 3600 + 56320 + 2147483647 + + + + IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER + + + + IPSEC_AUTH_SHA_1 + IPSEC_AUTH_CONFIG_HMAC_SHA_1_96 + + + + + + IPSEC_CIPHER_TYPE_3DES + IPSEC_CIPHER_CONFIG_CBC_3DES + + + + + + + IPSEC_PFS_NONE + + + + 3600 + 56320 + 2147483647 + + + + IPSEC_TRANSFORM_AH + + + IPSEC_AUTH_SHA_1 + IPSEC_AUTH_CONFIG_HMAC_SHA_1_96 + + + + + + IPSEC_PFS_NONE + + + + IPSEC_POLICY_FLAG_ND_BOUNDARY + + 10 + + 300 + 60 + + + + + IKEEXT_KERBEROS + + + + + + + IKEEXT_SSL + + IKEEXT_CERT_CONFIG_TRUSTED_ROOT_STORE + + + + + + 1 + + 1.3.6.1.5.5.7.3.2 + + + + + + + IKEEXT_CERT_CONFIG_TRUSTED_ROOT_STORE + + + + + + 2 + + 1.3.6.1.5.5.7.3.2 + 1.3.6.1.5.5.8.2.2 + + + + + + + + + + 1 + + 1.3.6.1.5.5.7.3.2 + + + + + + + + + + 1 + + 1.3.6.1.5.5.8.2.2 + + + + + + + + + + + + + + + + + + + IKEEXT_IMPERSONATION_SOCKET_PRINCIPAL + + + 9223372036854775809 + + + {30433c31-b05f-421f-8fde-018ea4c68af4} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_CONTEXT_FLAG_PERSISTENT + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 510075006100720061006e00740069006e0065002000440065006600610075006c0074000000 + Q.u.a.r.a.n.t.i.n.e. .D.e.f.a.u.l.t... + + 9223372036854775810 + + + {93132c36-6e06-4e6f-a10b-218787cd49cf} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_CONTEXT_FLAG_PERSISTENT + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 42006f006f007400740069006d0065002000440065006600610075006c0074000000 + B.o.o.t.t.i.m.e. .D.e.f.a.u.l.t... + + 9223372036854775811 + + + {252fe349-15c1-48d5-82a6-e62a2e483dcf} + + State Management Provider Context + Contains State Management Options + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_CLASSIFY_OPTIONS_CONTEXT + + + + FWP_CLASSIFY_OPTION_LOOSE_SOURCE_MAPPING + + FWP_UINT32 + 1 + + + + + 9223372036854775812 + + + {2ea412db-5c9d-4bbd-9af2-4914d2dbfe17} + + State Management Provider Context + Contains State Management Options + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_CLASSIFY_OPTIONS_CONTEXT + + + + FWP_CLASSIFY_OPTION_LOCAL_ONLY_MAPPING + + FWP_UINT32 + 1 + + + + + 9223372036854775813 + + + {9889f02d-6a85-49b4-8928-884e5ab5ee59} + + Policy Silent Mode Provider Context + The policy is inspected only but not enforced + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50006f006c00690063007900530069006c0065006e0074004d006f0064006500500072006f00760069006400650072000000 + P.o.l.i.c.y.S.i.l.e.n.t.M.o.d.e.P.r.o.v.i.d.e.r... + + 9223372036854775814 + + + {de04f4bd-a953-47f6-b1b6-eb6e24a546d6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5700530048002000440065006600610075006c0074000000 + W.S.H. .D.e.f.a.u.l.t... + + 9223372036854775815 + + + {feb49053-a00e-42a7-ab12-6f0b07ae1b2b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 51007500650072007900200055007300650072002000440065006600610075006c0074000000 + Q.u.e.r.y. .U.s.e.r. .D.e.f.a.u.l.t... + + 9223372036854775816 + + + {7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 41007000700043006f006e007400610069006e006500720020004c006f006f0070006200610063006b000000 + A.p.p.C.o.n.t.a.i.n.e.r. .L.o.o.p.b.a.c.k... + + 9223372036854775817 + + + {999ba50e-b870-4b5c-84e6-33a0e61cc8d1} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53007400650061006c00740068000000 + S.t.e.a.l.t.h... + + 9223372036854775818 + + + {20f3bb11-bbf6-4e60-aeb3-e651c675d642} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006800690065006c0064006500640020004d00610069006e002000520075006c0065000000 + S.h.i.e.l.d.e.d. .M.a.i.n. .R.u.l.e... + + 9223372036854776151 + + + {28127d58-a9af-43ee-bfe2-a06cb632fa4e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 440065006600610075006c007400200049006e0062006f0075006e0064000000 + D.e.f.a.u.l.t. .I.n.b.o.u.n.d... + + 9223372036854776154 + + + {df7bad3c-1c14-4ad9-ab82-5eb01bc9d76b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006800690065006c0064006500640020004d00610069006e002000520075006c0065000000 + S.h.i.e.l.d.e.d. .M.a.i.n. .R.u.l.e... + + 9223372036854776157 + + + {396a665b-ae9f-4c00-a33d-098abf605990} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 440065006600610075006c007400200049006e0062006f0075006e0064000000 + D.e.f.a.u.l.t. .I.n.b.o.u.n.d... + + 9223372036854776160 + + + {7a06a358-d5e2-4304-8970-c724ca7c9674} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006800690065006c0064006500640020004d00610069006e002000520075006c0065000000 + S.h.i.e.l.d.e.d. .M.a.i.n. .R.u.l.e... + + 9223372036854776163 + + + {abf0b72d-a22e-427e-9139-ebca0193e5d9} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 440065006600610075006c007400200049006e0062006f0075006e0064000000 + D.e.f.a.u.l.t. .I.n.b.o.u.n.d... + + 9223372036854776166 + + + {b36473ef-bf42-49b9-ac24-adba245e825c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5500570050002000440065006600610075006c007400200049006e0062006f0075006e006400200042006c006f0063006b002000520075006c0065000000 + U.W.P. .D.e.f.a.u.l.t. .I.n.b.o.u.n.d. .B.l.o.c.k. .R.u.l.e... + + 9223372036854776169 + + + {11ec8831-cda4-4bab-aa69-cb45e32f4ea9} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5500570050002000440065006600610075006c00740020004f007500740062006f0075006e006400200042006c006f0063006b002000520075006c0065000000 + U.W.P. .D.e.f.a.u.l.t. .O.u.t.b.o.u.n.d. .B.l.o.c.k. .R.u.l.e... + + 9223372036854776170 + + + {13fd7ae8-4dad-4362-9178-9991d6ac4670} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 41007500640069006f007300720076002d0031000000 + A.u.d.i.o.s.r.v.-.1... + + 9223372036854776171 + + + {74eff966-472f-46ce-9391-ad9e1303f145} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 41007500640069006f007300720076002d0032000000 + A.u.d.i.o.s.r.v.-.2... + + 9223372036854776172 + + + {ac7ae3b6-0cf9-4ae4-9212-6c452f977570} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4100560045006e00640070006f0069006e0074004200750069006c006400650072002d0031000000 + A.V.E.n.d.p.o.i.n.t.B.u.i.l.d.e.r.-.1... + + 9223372036854776173 + + + {2153ec13-392d-4ffd-aedb-b4818c4dc9f7} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4100560045006e00640070006f0069006e0074004200750069006c006400650072002d0032000000 + A.V.E.n.d.p.o.i.n.t.B.u.i.l.d.e.r.-.2... + + 9223372036854776174 + + + {a16428ab-a823-4c1e-aee4-9bce9dd30989} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4100780049006e0073007400530056002d0031000000 + A.x.I.n.s.t.S.V.-.1... + + 9223372036854776175 + + + {3cec65bf-a4e1-4376-b287-0691e08a6f63} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4100780049006e0073007400530056002d0033000000 + A.x.I.n.s.t.S.V.-.3... + + 9223372036854776176 + + + {9066c4f6-66a6-41fc-a268-07d1b287af42} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4200460045002d0031000000 + B.F.E.-.1... + + 9223372036854776177 + + + {dbc25b5e-745f-46f2-800b-2178e7367202} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4200460045002d0032000000 + B.F.E.-.2... + + 9223372036854776178 + + + {074c3ea9-af96-4a28-a6c6-db9b0335adb0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4300440050005300760063002d0032000000 + C.D.P.S.v.c.-.2... + + 9223372036854776179 + + + {e26c5b51-f344-4e59-b535-2ce78d16974c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4300440050005300760063002d0036000000 + C.D.P.S.v.c.-.6... + + 9223372036854776180 + + + {8966736d-4524-4694-9e2e-ee9f1387e011} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00330032002d0031000000 + c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.3.2.-.1... + + 9223372036854776181 + + + {bd49f24b-1801-46be-969c-e0cf5afd621a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00330032002d0032000000 + c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.3.2.-.2... + + 9223372036854776182 + + + {cc755386-b9e1-4342-a317-790c4f0a9534} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00360034002d0031000000 + c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.6.4.-.1... + + 9223372036854776183 + + + {bfa85b2e-3c06-4d69-b4e1-f149cff4661e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00360034002d0032000000 + c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.6.4.-.2... + + 9223372036854776184 + + + {a8b55da6-3aba-41f3-b7ba-443233f64fce} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0031000000 + D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.1... + + 9223372036854776185 + + + {c4e61e5c-3e66-4efb-b22b-87f8e56cf9c2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400650076006900630065004d0061006e006100670065006d0065006e0074002d00310030000000 + D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.1.0... + + 9223372036854776186 + + + {4dd4109f-8980-4e66-b307-887227d761a4} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400650076006900630065004d0061006e006100670065006d0065006e0074002d00310031000000 + D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.1.1... + + 9223372036854776187 + + + {f876928c-1566-4b9a-a110-57d531115565} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0032000000 + D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.2... + + 9223372036854776188 + + + {616fdcf3-1169-46b5-8224-cffc7276af2e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0034000000 + D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.4... + + 9223372036854776189 + + + {3742db91-517a-4f69-b378-08c5c09364b3} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0035000000 + D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.5... + + 9223372036854776190 + + + {49208958-c95e-48da-832f-60636a24827a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0037000000 + D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.7... + + 9223372036854776191 + + + {70f84089-a6de-44ab-88ba-681a2d87204e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400650076006900630065004d0061006e006100670065006d0065006e0074002d0038000000 + D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.8... + + 9223372036854776192 + + + {acc4c150-270a-47dc-91d0-23dcf4b073f4} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 44004800430050002d0034000000 + D.H.C.P.-.4... + + 9223372036854776193 + + + {fa7bff4f-61db-455f-8fec-220c1122cda0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 44004800430050002d0035000000 + D.H.C.P.-.5... + + 9223372036854776194 + + + {140da811-71af-4719-aea9-3e3196bb2c73} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 44006900730070006c006100790045006e00680061006e00630065006d0065006e00740053006500720076006900630065002000440065006e007900200041006c006c00200049006e0062006f0075006e0064000000 + D.i.s.p.l.a.y.E.n.h.a.n.c.e.m.e.n.t.S.e.r.v.i.c.e. .D.e.n.y. .A.l.l. .I.n.b.o.u.n.d... + + 9223372036854776195 + + + {e8b4f949-15cf-4ef0-8c72-4b472a399374} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 44006900730070006c006100790045006e00680061006e00630065006d0065006e00740053006500720076006900630065002000440065006e007900200041006c006c0020004f007500740062006f0075006e0064000000 + D.i.s.p.l.a.y.E.n.h.a.n.c.e.m.e.n.t.S.e.r.v.i.c.e. .D.e.n.y. .A.l.l. .O.u.t.b.o.u.n.d... + + 9223372036854776196 + + + {29442789-6efc-46ed-b261-a526c4b07a9b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 64006f00740033007300760063002d0031000000 + d.o.t.3.s.v.c.-.1... + + 9223372036854776197 + + + {39e96b50-7896-45bf-8a32-6df85e30668a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 64006f00740033007300760063002d0032000000 + d.o.t.3.s.v.c.-.2... + + 9223372036854776198 + + + {b9e16b36-f84a-4ada-8ad6-72303a132d9c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400500053002d0031000000 + D.P.S.-.1... + + 9223372036854776199 + + + {d7138c16-5c23-4147-8aa2-26c31ffa3282} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4400500053002d0032000000 + D.P.S.-.2... + + 9223372036854776200 + + + {56ca2cdd-1a5b-49db-b1b1-0c7ecda76a96} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4500760065006e0074006c006f0067002d0032000000 + E.v.e.n.t.l.o.g.-.2... + + 9223372036854776201 + + + {66d12cf5-d1c3-4fcf-beec-60486740a808} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4500760065006e0074006c006f0067002d0033000000 + E.v.e.n.t.l.o.g.-.3... + + 9223372036854776202 + + + {766e17d2-0adf-4c0c-a05f-bd0e3a611a0d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 66006400700068006f00730074002d0031000000 + f.d.p.h.o.s.t.-.1... + + 9223372036854776203 + + + {82c89ca7-9d25-44bf-b763-ae9a0fc19072} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 66006400700068006f00730074002d0032000000 + f.d.p.h.o.s.t.-.2... + + 9223372036854776204 + + + {d8d7429a-458d-419c-903a-72b1770c2fa5} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 660068007300760063002d0031000000 + f.h.s.v.c.-.1... + + 9223372036854776205 + + + {e4c31fb1-c4d0-4425-80cb-13aeaf564696} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 660068007300760063002d0032000000 + f.h.s.v.c.-.2... + + 9223372036854776206 + + + {4d390cf4-706e-4f3a-afc5-75de5af9327e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 48006900640053006500720076002d0031000000 + H.i.d.S.e.r.v.-.1... + + 9223372036854776207 + + + {a03a74d6-9d42-487f-9ebf-0576fb284312} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 48006900640053006500720076002d0032000000 + H.i.d.S.e.r.v.-.2... + + 9223372036854776208 + + + {dc9f453d-1eaa-4912-8a95-ec50252e8abd} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4c004d0048006f007300740073002d0033000000 + L.M.H.o.s.t.s.-.3... + + 9223372036854776209 + + + {7c926fc6-603b-4a56-bd0e-683fc579cb4b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4c004d0048006f007300740073002d0034000000 + L.M.H.o.s.t.s.-.4... + + 9223372036854776210 + + + {482ea2c8-fdf2-41e7-8c58-b77891b9e26e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4d006900630072006f0073006f00660074002d00570069006e0064006f00770073002d0041006c006c004a006f0079006e002d0052006f0075007400650072002d0042006c006f0063006b002d0049006e002d0041006c006c0045006c00730065000000 + M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.l.l.J.o.y.n.-.R.o.u.t.e.r.-.B.l.o.c.k.-.I.n.-.A.l.l.E.l.s.e... + + 9223372036854776211 + + + {b91e477a-b12b-4ffe-8036-fb467a589bb5} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4d006900630072006f0073006f00660074002d00570069006e0064006f00770073002d0041006c006c004a006f0079006e002d0052006f0075007400650072002d0042006c006f0063006b002d004f00750074002d0041006c006c0045006c00730065000000 + M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.l.l.J.o.y.n.-.R.o.u.t.e.r.-.B.l.o.c.k.-.O.u.t.-.A.l.l.E.l.s.e... + + 9223372036854776212 + + + {84a6277c-c2cf-4550-8617-4766635b0978} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4d00500053005300560043002d0031000000 + M.P.S.S.V.C.-.1... + + 9223372036854776213 + + + {9dc391c3-71d8-4649-b1d5-75ed10f360a9} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4d00500053005300560043002d0032000000 + M.P.S.S.V.C.-.2... + + 9223372036854776214 + + + {0565668f-d3c2-489b-86fc-63eaa40816b7} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4e00650074006d0061006e002d0031000000 + N.e.t.m.a.n.-.1... + + 9223372036854776215 + + + {e66edf14-6359-4ebf-a197-ba3f7537af1b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 4e00650074006d0061006e002d0032000000 + N.e.t.m.a.n.-.2... + + 9223372036854776216 + + + {a8703831-1566-41ef-a65d-e1810ef57048} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5000320050002000470072006f007500700069006e006700200042006c006f0063006b00200049006e000000 + P.2.P. .G.r.o.u.p.i.n.g. .B.l.o.c.k. .I.n... + + 9223372036854776217 + + + {07e62e11-172d-4a30-af90-caf4e66d513b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5000320050002000470072006f007500700069006e006700200042006c006f0063006b0020004f00750074000000 + P.2.P. .G.r.o.u.p.i.n.g. .B.l.o.c.k. .O.u.t... + + 9223372036854776218 + + + {1e2445fb-9e48-41aa-98ff-d540234e8a15} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50003200500020004900640065006e007400200042006c006f0063006b00200049006e000000 + P.2.P. .I.d.e.n.t. .B.l.o.c.k. .I.n... + + 9223372036854776219 + + + {4fbe1969-bcf9-4b68-8e7f-12bdb7f4b5c5} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50003200500020004900640065006e007400200042006c006f0063006b0020004f00750074000000 + P.2.P. .I.d.e.n.t. .B.l.o.c.k. .O.u.t... + + 9223372036854776220 + + + {2ec90dcd-0a0b-46e8-a930-97e228065a8d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5000630061005300760063002d0031000000 + P.c.a.S.v.c.-.1... + + 9223372036854776221 + + + {023d6954-db44-4559-875b-c888101ce60c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5000630061005300760063002d0032000000 + P.c.a.S.v.c.-.2... + + 9223372036854776222 + + + {0f745c88-3d06-4f3f-836a-246ed1fdb397} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 500065007200660048006f00730074002d0031000000 + P.e.r.f.H.o.s.t.-.1... + + 9223372036854776223 + + + {3f019c77-26df-4344-96a3-327d030483fd} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 500065007200660048006f00730074002d0032000000 + P.e.r.f.H.o.s.t.-.2... + + 9223372036854776224 + + + {e39d0a93-3337-4e1e-b56a-d00861b1f26a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50004e0052005000200042006c006f0063006b00200049006e000000 + P.N.R.P. .B.l.o.c.k. .I.n... + + 9223372036854776225 + + + {c4c5bf1b-6190-4fdc-95ec-0d4ba3d09dbc} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50004e0052005000200042006c006f0063006b0020004f00750074000000 + P.N.R.P. .B.l.o.c.k. .O.u.t... + + 9223372036854776226 + + + {d7744c01-2520-4e53-9d09-1b4c41561898} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50006e00720070004100750074006f00200042006c006f0063006b00200049006e000000 + P.n.r.p.A.u.t.o. .B.l.o.c.k. .I.n... + + 9223372036854776227 + + + {f293ff68-0301-4ecb-9c6f-b0b73b0c0f99} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50006e00720070004100750074006f00200042006c006f0063006b0020004f00750074000000 + P.n.r.p.A.u.t.o. .B.l.o.c.k. .O.u.t... + + 9223372036854776228 + + + {08edbc40-f085-4664-8cf6-cfb6e9ebe8f6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50006f006c006900630079004100670065006e0074002d0034000000 + P.o.l.i.c.y.A.g.e.n.t.-.4... + + 9223372036854776229 + + + {542d5137-d23a-4bb4-8d90-9c30857d84bc} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50006f006c006900630079004100670065006e0074002d0035000000 + P.o.l.i.c.y.A.g.e.n.t.-.5... + + 9223372036854776230 + + + {3a5e8a34-82df-4083-a6ed-87ea8ed3507a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 530065006100720063006800460069006c0074006500720048006f00730074002d0031000000 + S.e.a.r.c.h.F.i.l.t.e.r.H.o.s.t.-.1... + + 9223372036854776231 + + + {03843031-9e01-449d-b94b-047c6fbe714c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 530065006100720063006800460069006c0074006500720048006f00730074002d0032000000 + S.e.a.r.c.h.F.i.l.t.e.r.H.o.s.t.-.2... + + 9223372036854776232 + + + {bbe3095e-afe8-4c43-8de5-b9994738a268} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006500610072006300680049006e00640065007800650072002d0031000000 + S.e.a.r.c.h.I.n.d.e.x.e.r.-.1... + + 9223372036854776233 + + + {c7031a73-1778-4847-9b46-8ce7fa8798c1} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006500610072006300680049006e00640065007800650072002d0032000000 + S.e.a.r.c.h.I.n.d.e.x.e.r.-.2... + + 9223372036854776234 + + + {c0cedbe2-34f4-4491-bd19-152a55b1b6e0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 530065006100720063006800500072006f0074006f0063006f006c0048006f00730074002d0031000000 + S.e.a.r.c.h.P.r.o.t.o.c.o.l.H.o.s.t.-.1... + + 9223372036854776235 + + + {be0ee23e-c670-47d6-8112-7cf182d22041} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53004e004d00500054005200410050002d0032000000 + S.N.M.P.T.R.A.P.-.2... + + 9223372036854776236 + + + {b508cf8d-5dbe-44e9-bc10-85402404c8f4} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53004e004d00500054005200410050002d0033000000 + S.N.M.P.T.R.A.P.-.3... + + 9223372036854776237 + + + {7b84e8bb-fa4a-42c3-b61d-6e2b0532fdc5} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53005000500045005800540043004f004d004f0042004a002d0033000000 + S.P.P.E.X.T.C.O.M.O.B.J.-.3... + + 9223372036854776238 + + + {6cc74acd-ca95-45f6-8c3b-5e62000940b0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53005000500045005800540043004f004d004f0042004a002d0034000000 + S.P.P.E.X.T.C.O.M.O.B.J.-.4... + + 9223372036854776239 + + + {f63fb925-3743-4a88-95ed-a842472b93fc} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5300790073006d00610069006e002d0031000000 + S.y.s.m.a.i.n.-.1... + + 9223372036854776240 + + + {0613da54-aa3d-4d9d-afd6-d4d64f655001} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5300790073006d00610069006e002d0032000000 + S.y.s.m.a.i.n.-.2... + + 9223372036854776241 + + + {d8e3c9f1-31ab-441a-896a-8c4b0d3b2019} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5400610062006c006500740049006e0070007500740053006500720076006900630065002d0031000000 + T.a.b.l.e.t.I.n.p.u.t.S.e.r.v.i.c.e.-.1... + + 9223372036854776242 + + + {cfcaf1e6-48d2-47d1-a1e3-d7b017af03ee} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5400610062006c006500740049006e0070007500740053006500720076006900630065002d0032000000 + T.a.b.l.e.t.I.n.p.u.t.S.e.r.v.i.c.e.-.2... + + 9223372036854776243 + + + {7b6dc94c-eb68-4c29-9f34-589b83c2f93a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 540072006b0077006b0073002d0031000000 + T.r.k.w.k.s.-.1... + + 9223372036854776244 + + + {42e3bde9-8223-45ae-a948-b331cfad1178} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 540072006b0077006b0073002d0032000000 + T.r.k.w.k.s.-.2... + + 9223372036854776245 + + + {f5ce7aa1-73b7-4368-8117-1b81a708a5b8} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 55006d0052006400700053006500720076006900630065002d0031000000 + U.m.R.d.p.S.e.r.v.i.c.e.-.1... + + 9223372036854776246 + + + {09581f72-a5fa-4f0d-83c1-e0a072bb2e5c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 55006d0052006400700053006500720076006900630065002d0032000000 + U.m.R.d.p.S.e.r.v.i.c.e.-.2... + + 9223372036854776247 + + + {89946940-1d3d-4828-baf2-ef863ff4d926} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5600610063005300760063002d0031000000 + V.a.c.S.v.c.-.1... + + 9223372036854776248 + + + {09c48c05-27b6-4ee0-99f7-a39203499a80} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5600610063005300760063002d0032000000 + V.a.c.S.v.c.-.2... + + 9223372036854776249 + + + {20ba781c-7644-4706-9a3d-3cadb206da34} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5600440053002d0031000000 + V.D.S.-.1... + + 9223372036854776250 + + + {de982dfe-87db-49d3-ab9e-fd063af6cf3e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063006700750065007300740069006e0074006500720066006100630065002d0062006c006f0063006b002d0069006e000000 + v.m.i.c.g.u.e.s.t.i.n.t.e.r.f.a.c.e.-.b.l.o.c.k.-.i.n... + + 9223372036854776251 + + + {66d956e2-2f1d-424c-9d3c-48ae68b15ed6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063006700750065007300740069006e0074006500720066006100630065002d0062006c006f0063006b002d006f00750074000000 + v.m.i.c.g.u.e.s.t.i.n.t.e.r.f.a.c.e.-.b.l.o.c.k.-.o.u.t... + + 9223372036854776252 + + + {36a4e3cc-ec47-49eb-977f-e55f10f19083} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063006800650061007200740062006500610074002d0062006c006f0063006b002d0069006e000000 + v.m.i.c.h.e.a.r.t.b.e.a.t.-.b.l.o.c.k.-.i.n... + + 9223372036854776253 + + + {8293ae37-bed3-4430-a7a4-68b06342c2e2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063006800650061007200740062006500610074002d0062006c006f0063006b002d006f00750074000000 + v.m.i.c.h.e.a.r.t.b.e.a.t.-.b.l.o.c.k.-.o.u.t... + + 9223372036854776254 + + + {fcc62406-2a46-4704-8605-51da6478c028} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063006b0076007000650078006300680061006e00670065002d0062006c006f0063006b002d0069006e000000 + v.m.i.c.k.v.p.e.x.c.h.a.n.g.e.-.b.l.o.c.k.-.i.n... + + 9223372036854776255 + + + {996f6ad1-478b-49a3-9ac5-9278bbfdab90} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063006b0076007000650078006300680061006e00670065002d0062006c006f0063006b002d006f00750074000000 + v.m.i.c.k.v.p.e.x.c.h.a.n.g.e.-.b.l.o.c.k.-.o.u.t... + + 9223372036854776256 + + + {c9a666f9-bc1e-4e39-9ee6-52940117aad8} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063007200640076002d0062006c006f0063006b002d0069006e000000 + v.m.i.c.r.d.v.-.b.l.o.c.k.-.i.n... + + 9223372036854776257 + + + {19d55ef7-9fd1-43d0-b47c-b7752e875f3e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063007200640076002d0062006c006f0063006b002d006f00750074000000 + v.m.i.c.r.d.v.-.b.l.o.c.k.-.o.u.t... + + 9223372036854776258 + + + {79d972a5-c160-4af7-b091-58da324a4ff0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d0069006300730068007500740064006f0077006e002d0062006c006f0063006b002d0069006e000000 + v.m.i.c.s.h.u.t.d.o.w.n.-.b.l.o.c.k.-.i.n... + + 9223372036854776259 + + + {2c1956cf-17bc-4820-b44d-522f9985dc29} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d0069006300730068007500740064006f0077006e002d0062006c006f0063006b002d006f00750074000000 + v.m.i.c.s.h.u.t.d.o.w.n.-.b.l.o.c.k.-.o.u.t... + + 9223372036854776260 + + + {0c6406d9-1628-4c44-b2da-b5f8ca525a44} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d0069006300740069006d006500730079006e0063002d0062006c006f0063006b002d0069006e000000 + v.m.i.c.t.i.m.e.s.y.n.c.-.b.l.o.c.k.-.i.n... + + 9223372036854776261 + + + {f245355c-3927-4d7a-b7eb-57a3db7827c6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d0069006300740069006d006500730079006e0063002d0062006c006f0063006b002d006f00750074000000 + v.m.i.c.t.i.m.e.s.y.n.c.-.b.l.o.c.k.-.o.u.t... + + 9223372036854776262 + + + {b4fc7eca-e42d-4ae1-a29e-bc721cde5535} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d006900630076006d00730065007300730069006f006e002d0062006c006f0063006b002d0069006e000000 + v.m.i.c.v.m.s.e.s.s.i.o.n.-.b.l.o.c.k.-.i.n... + + 9223372036854776263 + + + {3c267f8e-944d-4068-acad-75ba5821575b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d006900630076006d00730065007300730069006f006e002d0062006c006f0063006b002d006f00750074000000 + v.m.i.c.v.m.s.e.s.s.i.o.n.-.b.l.o.c.k.-.o.u.t... + + 9223372036854776264 + + + {c58cd9f2-b4e4-43f5-b494-d7260d82f973} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063007600730073002d0062006c006f0063006b002d0069006e000000 + v.m.i.c.v.s.s.-.b.l.o.c.k.-.i.n... + + 9223372036854776265 + + + {1622032e-7b49-4f11-b377-d2c73c90bcc8} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 76006d00690063007600730073002d0062006c006f0063006b002d006f00750074000000 + v.m.i.c.v.s.s.-.b.l.o.c.k.-.o.u.t... + + 9223372036854776266 + + + {a5086f3a-f5e4-481e-8caf-1ff0204b001c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7700620065006e00670069006e0065002d0031000000 + w.b.e.n.g.i.n.e.-.1... + + 9223372036854776267 + + + {c2733d72-d500-4045-94f2-09606cd6dbc6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7700620065006e00670069006e0065002d0033000000 + w.b.e.n.g.i.n.e.-.3... + + 9223372036854776268 + + + {c6f5a818-b954-42a7-b596-45591ca10f6a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 570063006d007300760063002d0031000000 + W.c.m.s.v.c.-.1... + + 9223372036854776269 + + + {f87d269f-537e-4352-b018-87e5976976f7} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 570063006d007300760063002d0033000000 + W.c.m.s.v.c.-.3... + + 9223372036854776270 + + + {0c3cddb6-de83-4012-8dca-52a7682f97da} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 570064006900530079007300740065006d0048006f00730074002d0031000000 + W.d.i.S.y.s.t.e.m.H.o.s.t.-.1... + + 9223372036854776271 + + + {ffd72c64-50dc-4b5b-8b1e-1dfe782f4d0d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 570064006900530079007300740065006d0048006f00730074002d0032000000 + W.d.i.S.y.s.t.e.m.H.o.s.t.-.2... + + 9223372036854776272 + + + {9a09d870-2858-4be6-9e2f-ce10b4907fa0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5700650072005300760063002d0031000000 + W.e.r.S.v.c.-.1... + + 9223372036854776273 + + + {c54b278f-9127-40bf-aa5e-86674fa65c76} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5700650072005300760063002d0032000000 + W.e.r.S.v.c.-.2... + + 9223372036854776274 + + + {690f4ad8-bc37-48b7-bed6-bfa7a526a895} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 570069006e0064006f007700730044006500660065006e006400650072002d0032000000 + W.i.n.d.o.w.s.D.e.f.e.n.d.e.r.-.2... + + 9223372036854776275 + + + {cdfd6c38-1499-44b4-a900-60aa4e8936c2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 570069006e0064006f007700730044006500660065006e006400650072002d0033000000 + W.i.n.d.o.w.s.D.e.f.e.n.d.e.r.-.3... + + 9223372036854776276 + + + {22d7902a-15f9-4e7c-85fa-062e993aa6d5} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 570069006e0048007400740070004100750074006f00500072006f00780079005300760063002d0032000000 + W.i.n.H.t.t.p.A.u.t.o.P.r.o.x.y.S.v.c.-.2... + + 9223372036854776277 + + + {2810cbd2-88bb-47d7-a215-409c6cd87bee} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 570069006e0048007400740070004100750074006f00500072006f00780079005300760063002d0033000000 + W.i.n.H.t.t.p.A.u.t.o.P.r.o.x.y.S.v.c.-.3... + + 9223372036854776278 + + + {359ad55a-40a5-45e0-91ba-c921ac9cb876} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 57006c0061006e007300760063002d0031000000 + W.l.a.n.s.v.c.-.1... + + 9223372036854776279 + + + {c9368850-7641-4a64-9c8d-91c38550f267} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 57006c0061006e007300760063002d0032000000 + W.l.a.n.s.v.c.-.2... + + 9223372036854776280 + + + {e4bb7146-61ab-49c8-b9f3-57e9d27207e1} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 77006c00700061007300760063002d0031000000 + w.l.p.a.s.v.c.-.1... + + 9223372036854776281 + + + {478442b4-ce51-424a-991f-9207b636722c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 77006c00700061007300760063002d0033000000 + w.l.p.a.s.v.c.-.3... + + 9223372036854776282 + + + {10cc650c-46e4-40e3-b9d8-1e34fee2055f} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5700530043002000440065006e007900200041006c006c00200049006e0062006f0075006e0064000000 + W.S.C. .D.e.n.y. .A.l.l. .I.n.b.o.u.n.d... + + 9223372036854776283 + + + {fece87b4-8033-4dbe-a385-6bc285eb6d78} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5700530043002000440065006e007900200041006c006c0020004f007500740062006f0075006e0064000000 + W.S.C. .D.e.n.y. .A.l.l. .O.u.t.b.o.u.n.d... + + 9223372036854776284 + + + {9724c57d-1990-4c1f-b17d-8847702bfcef} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5700770061006e005300760063002d0031000000 + W.w.a.n.S.v.c.-.1... + + 9223372036854776285 + + + {c0ff73ea-8d25-4280-a754-96b67c932869} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 5700770061006e005300760063002d0032000000 + W.w.a.n.S.v.c.-.2... + + 9223372036854776286 + + + {ed046545-5b2c-4368-b04e-e93ca55def93} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 410073007300690067006e00650064004100630063006500730073004d0061006e0061006700650072005300760063002d0031000000 + A.s.s.i.g.n.e.d.A.c.c.e.s.s.M.a.n.a.g.e.r.S.v.c.-.1... + + 9223372036854776287 + + + {1b7af7da-20ed-4fb5-9eb4-3e63fcb7536c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 410073007300690067006e00650064004100630063006500730073004d0061006e0061006700650072005300760063002d0032000000 + A.s.s.i.g.n.e.d.A.c.c.e.s.s.M.a.n.a.g.e.r.S.v.c.-.2... + + 9223372036854776288 + + + {6796b00a-0007-4eeb-b176-41c6807585a4} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 63006c006f0075006400690064007300760063002d0062006c006f0063006b002d0069006e000000 + c.l.o.u.d.i.d.s.v.c.-.b.l.o.c.k.-.i.n... + + 9223372036854776289 + + + {774ac201-15c6-444f-82c9-1dcdff4326f2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 63006c006f0075006400690064007300760063002d0062006c006f0063006b002d006f00750074000000 + c.l.o.u.d.i.d.s.v.c.-.b.l.o.c.k.-.o.u.t... + + 9223372036854776290 + + + {b47fa28f-cdca-41e8-8360-733d8216d7f9} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 43007300630053006500720076006900630065002d0031000000 + C.s.c.S.e.r.v.i.c.e.-.1... + + 9223372036854776291 + + + {6e9a9b45-a4cb-4723-bd55-60149243222d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 43007300630053006500720076006900630065002d0032000000 + C.s.c.S.e.r.v.i.c.e.-.2... + + 9223372036854776292 + + + {5845f29b-b4a1-4df2-b66e-609e5f902183} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50006500650072004400690073007400200042006c006f0063006b00200049006e000000 + P.e.e.r.D.i.s.t. .B.l.o.c.k. .I.n... + + 9223372036854776293 + + + {e22f0814-cca5-4de3-8991-4f296ccec7a5} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 50006500650072004400690073007400200042006c006f0063006b0020004f00750074000000 + P.e.e.r.D.i.s.t. .B.l.o.c.k. .O.u.t... + + 9223372036854776294 + + + {66e8985e-169a-4c11-9701-40419c45a9cc} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 57005000440042005500530045004e0055004d002d0031000000 + W.P.D.B.U.S.E.N.U.M.-.1... + + 9223372036854776295 + + + {cfef2756-ac04-449a-b6c6-ed010f460651} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 57005000440042005500530045004e0055004d002d0032000000 + W.P.D.B.U.S.E.N.U.M.-.2... + + 9223372036854776296 + + + {2d39a837-d11e-4242-aa55-d55d0d92ae68} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 640064003400340036003600360033002d0030003000380036002d0034006100390037002d0038003000370061002d006100380033006500390035006400640038003400640038000000 + d.d.4.4.6.6.6.3.-.0.0.8.6.-.4.a.9.7.-.8.0.7.a.-.a.8.3.e.9.5.d.d.8.4.d.8... + + 9223372036854776297 + + + {19d6b0d9-e808-4803-a59f-92ae87bf4b00} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 300033006400320066006500650030002d0031006100640065002d0034003800610036002d0061003700640030002d003100390033006200610064003000310035003100330038000000 + 0.3.d.2.f.e.e.0.-.1.a.d.e.-.4.8.a.6.-.a.7.d.0.-.1.9.3.b.a.d.0.1.5.1.3.8... + + 9223372036854776298 + + + {522717a3-989a-403d-8bd9-2301754f6bd4} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00340038003500440036003700310044002d0041003500330037002d0034003800410037002d0039003000440035002d003600370038003300380041003500420041004100320045007d000000 + {.4.8.5.D.6.7.1.D.-.A.5.3.7.-.4.8.A.7.-.9.0.D.5.-.6.7.8.3.8.A.5.B.A.A.2.E.}... + + 9223372036854776299 + + + {fcb5f99f-cabd-4580-b4f4-d8bb7629abd2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310043003100420039003600340036002d0032004200340046002d0034003300450046002d0038004300350042002d003300460039003000300042003700310034004100410042007d000000 + {.1.C.1.B.9.6.4.6.-.2.B.4.F.-.4.3.E.F.-.8.C.5.B.-.3.F.9.0.0.B.7.1.4.A.A.B.}... + + 9223372036854776300 + + + {68d4ff07-c138-454b-aa7e-316622d0a73c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310044004400440045003200300038002d0032004500330032002d0034003200410045002d0038003800380046002d004200440043003200380038003000380036004500300032007d000000 + {.1.D.D.D.E.2.0.8.-.2.E.3.2.-.4.2.A.E.-.8.8.8.F.-.B.D.C.2.8.8.0.8.6.E.0.2.}... + + 9223372036854776301 + + + {4237d279-1e81-4828-958f-467bf3a5349b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00360038003600420038003300350039002d0031003200330043002d0034003100370032002d0042003100330033002d004200390032003000350030003900320036003300440033007d000000 + {.6.8.6.B.8.3.5.9.-.1.2.3.C.-.4.1.7.2.-.B.1.3.3.-.B.9.2.0.5.0.9.2.6.3.D.3.}... + + 9223372036854776302 + + + {6a19fa7f-ef2b-42cf-b2d6-8139181d816b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450045003400340044004100450041002d0034003100390036002d0034003000450036002d0041003900370030002d003500340038003500330043004400460045003900440041007d000000 + {.E.E.4.4.D.A.E.A.-.4.1.9.6.-.4.0.E.6.-.A.9.7.0.-.5.4.8.5.3.C.D.F.E.9.D.A.}... + + 9223372036854776303 + + + {52026488-b6af-4372-9685-0d69706e6683} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00330038004300380037004200360045002d0034004600410031002d0034004400440043002d0042004300460043002d003600360033004500450035003600450030004300430030007d000000 + {.3.8.C.8.7.B.6.E.-.4.F.A.1.-.4.D.D.C.-.B.C.F.C.-.6.6.3.E.E.5.6.E.0.C.C.0.}... + + 9223372036854776304 + + + {249d04ff-49a5-4e08-87e9-0e68e2019df7} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00460041004400390039003200330043002d0034003900320030002d0034003200310030002d0038004400300042002d003400310030004600300039003100440043004300300043007d000000 + {.F.A.D.9.9.2.3.C.-.4.9.2.0.-.4.2.1.0.-.8.D.0.B.-.4.1.0.F.0.9.1.D.C.C.0.C.}... + + 9223372036854776305 + + + {cbc261c4-d5fd-4e97-8de5-9c64f045fbb0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440034004100460032003900380030002d0039004600370038002d0034004300390041002d0039003700430030002d003800390046003300360030004300390042004300380039007d000000 + {.D.4.A.F.2.9.8.0.-.9.F.7.8.-.4.C.9.A.-.9.7.C.0.-.8.9.F.3.6.0.C.9.B.C.8.9.}... + + 9223372036854776306 + + + {f369fb4f-039a-40d7-89c4-e9d1636f38e1} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00460033004300450030003900350037002d0042004600320039002d0034003200300035002d0038003000350046002d003800450033004400350045003000390037003300340042007d000000 + {.F.3.C.E.0.9.5.7.-.B.F.2.9.-.4.2.0.5.-.8.0.5.F.-.8.E.3.D.5.E.0.9.7.3.4.B.}... + + 9223372036854776307 + + + {c29535e1-3bbf-4491-bfe8-020381591955} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370044003900370038003700380042002d0043003900310041002d0034003200460034002d0038003700360034002d003300440037004500320030003400310038003400370030007d000000 + {.7.D.9.7.8.7.8.B.-.C.9.1.A.-.4.2.F.4.-.8.7.6.4.-.3.D.7.E.2.0.4.1.8.4.7.0.}... + + 9223372036854776308 + + + {b1f4be4b-02f3-4fe6-9da0-489362bd0b71} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00410042003600410042004400320035002d0038003300420030002d0034003200390030002d0041003700420045002d003400340035003300410042003000370035003100460031007d000000 + {.A.B.6.A.B.D.2.5.-.8.3.B.0.-.4.2.9.0.-.A.7.B.E.-.4.4.5.3.A.B.0.7.5.1.F.1.}... + + 9223372036854776309 + + + {7eb2b4ea-2142-4c7e-a44f-ebb62240040d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00360038003300380041003400340035002d0030004200460033002d0034004500390046002d0042004500410044002d004400320045003900420044003700320042004500460044007d000000 + {.6.8.3.8.A.4.4.5.-.0.B.F.3.-.4.E.9.F.-.B.E.A.D.-.D.2.E.9.B.D.7.2.B.E.F.D.}... + + 9223372036854776310 + + + {176827d1-c164-4c39-8c31-3afecc6a8b87} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430044003500440034003000450046002d0042004500350036002d0034003500440034002d0042003400300035002d003900350031003500450038004400310034003300410037007d000000 + {.C.D.5.D.4.0.E.F.-.B.E.5.6.-.4.5.D.4.-.B.4.0.5.-.9.5.1.5.E.8.D.1.4.3.A.7.}... + + 9223372036854776311 + + + {5f6a0bbb-a184-4846-b780-05f78b81c312} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370034004600340043004500410031002d0032003600430031002d0034003100440036002d0038003900450042002d004400430033003700450037004600310039003600410033007d000000 + {.7.4.F.4.C.E.A.1.-.2.6.C.1.-.4.1.D.6.-.8.9.E.B.-.D.C.3.7.E.7.F.1.9.6.A.3.}... + + 9223372036854776312 + + + {2b60bea0-0fb8-431e-b6bc-2ecb692ddb06} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00390035003700300036004600330030002d0045004400300035002d0034004500370043002d0041003800440041002d003300350045004500360037003700420036003000360042007d000000 + {.9.5.7.0.6.F.3.0.-.E.D.0.5.-.4.E.7.C.-.A.8.D.A.-.3.5.E.E.6.7.7.B.6.0.6.B.}... + + 9223372036854776313 + + + {39ba4b09-2547-445d-a928-30377b0904fc} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450032004500430033003600380038002d0046003000300035002d0034004200430036002d0041003700420046002d003100360032003900410042004600350031003000300041007d000000 + {.E.2.E.C.3.6.8.8.-.F.0.0.5.-.4.B.C.6.-.A.7.B.F.-.1.6.2.9.A.B.F.5.1.0.0.A.}... + + 9223372036854776314 + + + {eab91178-7ca7-4e7c-9c51-b0fb5529aeec} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310034003500420039003500350046002d0038003200430041002d0034003700360036002d0038004600430037002d004500360033003700330039003000370042004400390046007d000000 + {.1.4.5.B.9.5.5.F.-.8.2.C.A.-.4.7.6.6.-.8.F.C.7.-.E.6.3.7.3.9.0.7.B.D.9.F.}... + + 9223372036854776315 + + + {172590db-b33f-47df-9a24-df562ac3ec0f} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320032003000370041004400310042002d0034003600330036002d0034003100340033002d0038004100390034002d004100310041003400330041003100310032004300330042007d000000 + {.2.2.0.7.A.D.1.B.-.4.6.3.6.-.4.1.4.3.-.8.A.9.4.-.A.1.A.4.3.A.1.1.2.C.3.B.}... + + 9223372036854776316 + + + {6a3f64d4-864f-42ed-9dd8-30a826e49a5a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320046004500440031003700460037002d0033003000300039002d0034003800440043002d0041003600320036002d003200360030004400420046004500370039003400310035007d000000 + {.2.F.E.D.1.7.F.7.-.3.0.0.9.-.4.8.D.C.-.A.6.2.6.-.2.6.0.D.B.F.E.7.9.4.1.5.}... + + 9223372036854776317 + + + {74988442-3bfb-451c-9a63-9eabb07c4485} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300031003200340036004100430030002d0043003800340039002d0034003100370036002d0042003400330030002d003500440046003000350046004600330041003200370036007d000000 + {.0.1.2.4.6.A.C.0.-.C.8.4.9.-.4.1.7.6.-.B.4.3.0.-.5.D.F.0.5.F.F.3.A.2.7.6.}... + + 9223372036854776318 + + + {5f35226f-d9fa-4d44-8136-27a1c662a034} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00410033004400440044004200360043002d0041003800300043002d0034004300450033002d0039003400420036002d003400320035004500390045004400380037004200390044007d000000 + {.A.3.D.D.D.B.6.C.-.A.8.0.C.-.4.C.E.3.-.9.4.B.6.-.4.2.5.E.9.E.D.8.7.B.9.D.}... + + 9223372036854776319 + + + {ee701874-f029-4ad6-b10b-a96448806f5e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00360030003700390035003700380033002d0037004100340043002d0034003700380035002d0041003100300037002d003600380043003900350036004100330042004500380037007d000000 + {.6.0.7.9.5.7.8.3.-.7.A.4.C.-.4.7.8.5.-.A.1.0.7.-.6.8.C.9.5.6.A.3.B.E.8.7.}... + + 9223372036854776320 + + + {f51c59dd-efbf-4d67-8098-1ed8362db864} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310037004200450034004600360034002d0033004500360031002d0034004200420037002d0039003400450031002d003200330042004500320042003800320038004600330038007d000000 + {.1.7.B.E.4.F.6.4.-.3.E.6.1.-.4.B.B.7.-.9.4.E.1.-.2.3.B.E.2.B.8.2.8.F.3.8.}... + + 9223372036854776321 + + + {4118e8a8-7bc3-4cfa-bc76-b58807f4b331} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300037004500340031004500350039002d0032004100330036002d0034003700300036002d0039003200310041002d003500420038003200410037003900380043004600350042007d000000 + {.0.7.E.4.1.E.5.9.-.2.A.3.6.-.4.7.0.6.-.9.2.1.A.-.5.B.8.2.A.7.9.8.C.F.5.B.}... + + 9223372036854776322 + + + {4cb1e008-1717-41de-b54b-002f7f5ee7ed} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00410041003900420033003900370044002d0030003700360042002d0034003700390042002d0042004600310046002d003500390034003100350044004400430030004300390046007d000000 + {.A.A.9.B.3.9.7.D.-.0.7.6.B.-.4.7.9.B.-.B.F.1.F.-.5.9.4.1.5.D.D.C.0.C.9.F.}... + + 9223372036854776323 + + + {c78cca83-d284-4994-afa2-36f2d141092d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440046003600310037004500420035002d0042003400450044002d0034004500410038002d0039003700420039002d004100360038003300460045004400330035004500350031007d000000 + {.D.F.6.1.7.E.B.5.-.B.4.E.D.-.4.E.A.8.-.9.7.B.9.-.A.6.8.3.F.E.D.3.5.E.5.1.}... + + 9223372036854776324 + + + {3992e37e-b141-4b1e-97c7-91a13aad3f4d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430032003800340030004100430043002d0032003500300034002d0034003300430046002d0038003900460045002d004200380035004500440044003600360034003400320032007d000000 + {.C.2.8.4.0.A.C.C.-.2.5.0.4.-.4.3.C.F.-.8.9.F.E.-.B.8.5.E.D.D.6.6.4.4.2.2.}... + + 9223372036854776325 + + + {05ec7931-2f4c-41be-a2ea-6d51d1bbbece} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00460044003800390030003600430042002d0045004400430033002d0034003500320031002d0038003000370037002d004600330036004600410038004400320038003900410044007d000000 + {.F.D.8.9.0.6.C.B.-.E.D.C.3.-.4.5.2.1.-.8.0.7.7.-.F.3.6.F.A.8.D.2.8.9.A.D.}... + + 9223372036854776326 + + + {99d123c2-3b7b-4ed4-9ec8-db4045ecab9c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370037003800310044003600460038002d0036003100420046002d0034004500310030002d0042003400310042002d003000350045004200420045003800340036004500390045007d000000 + {.7.7.8.1.D.6.F.8.-.6.1.B.F.-.4.E.1.0.-.B.4.1.B.-.0.5.E.B.B.E.8.4.6.E.9.E.}... + + 9223372036854776327 + + + {f1e8ae28-b94f-4ea4-8146-effcf1aab52d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350037003800340038004300320043002d0044003800310034002d0034003600450036002d0041003500360030002d003000330043003700390035003700330039003400330041007d000000 + {.5.7.8.4.8.C.2.C.-.D.8.1.4.-.4.6.E.6.-.A.5.6.0.-.0.3.C.7.9.5.7.3.9.4.3.A.}... + + 9223372036854776328 + + + {f110ffcf-96c3-4478-bb37-1b945cb78a70} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370030003400320031004100330042002d0045003900410039002d0034003000360043002d0039003400350036002d003400430044003000380030003300430046003000350041007d000000 + {.7.0.4.2.1.A.3.B.-.E.9.A.9.-.4.0.6.C.-.9.4.5.6.-.4.C.D.0.8.0.3.C.F.0.5.A.}... + + 9223372036854776329 + + + {f981bff2-8c56-445e-8cb7-96a027e9f6b1} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00420041004500300032004400420044002d0032003600420031002d0034004100340037002d0039003200390030002d003400300030003200360043003800380043003900390034007d000000 + {.B.A.E.0.2.D.B.D.-.2.6.B.1.-.4.A.4.7.-.9.2.9.0.-.4.0.0.2.6.C.8.8.C.9.9.4.}... + + 9223372036854776330 + + + {fefb887e-0b75-460c-9c27-d56487aac61a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320033003600390033004600450030002d0031003800380039002d0034003500320044002d0039004600450030002d004100390045004600420030003000390033003700330042007d000000 + {.2.3.6.9.3.F.E.0.-.1.8.8.9.-.4.5.2.D.-.9.F.E.0.-.A.9.E.F.B.0.0.9.3.7.3.B.}... + + 9223372036854776331 + + + {160c36c9-0822-478c-95ee-e5f979416fbb} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350033003200380036004400320043002d0043004400460046002d0034003900450035002d0039004600320039002d004400370043004500450043004100440037003900410036007d000000 + {.5.3.2.8.6.D.2.C.-.C.D.F.F.-.4.9.E.5.-.9.F.2.9.-.D.7.C.E.E.C.A.D.7.9.A.6.}... + + 9223372036854776332 + + + {a005febd-1b7b-4a86-90cc-92d03d4ef881} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440041003700430032004600380033002d0030004200370031002d0034004600300044002d0042004200350030002d003700460039003300390032004200380031003000380032007d000000 + {.D.A.7.C.2.F.8.3.-.0.B.7.1.-.4.F.0.D.-.B.B.5.0.-.7.F.9.3.9.2.B.8.1.0.8.2.}... + + 9223372036854776333 + + + {d1a7f6b9-32b7-43f3-9c54-729684ef4756} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00460037003400360033003500310031002d0039004400300030002d0034004300420045002d0041003300420031002d003900430031004100350031003100360042004100310032007d000000 + {.F.7.4.6.3.5.1.1.-.9.D.0.0.-.4.C.B.E.-.A.3.B.1.-.9.C.1.A.5.1.1.6.B.A.1.2.}... + + 9223372036854776334 + + + {eb407abd-ec36-44d8-8fc6-881762cd0741} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430038004300410039004500310043002d0039003800370038002d0034004100440044002d0038003000450033002d003700420045003700360035003000330041004600340045007d000000 + {.C.8.C.A.9.E.1.C.-.9.8.7.8.-.4.A.D.D.-.8.0.E.3.-.7.B.E.7.6.5.0.3.A.F.4.E.}... + + 9223372036854776335 + + + {f38530b7-9907-4f2e-be76-f1071e6395f0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00340039004600330032003800430042002d0044003500320046002d0034004100340044002d0041003800430032002d003900320036004200440034003600300037003800360038007d000000 + {.4.9.F.3.2.8.C.B.-.D.5.2.F.-.4.A.4.D.-.A.8.C.2.-.9.2.6.B.D.4.6.0.7.8.6.8.}... + + 9223372036854776336 + + + {45f882ef-306e-4e41-bf2b-e06259932b00} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00380031003400440032003200450033002d0046003000440042002d0034003900380034002d0039003800330046002d004200430033003200360039003600420045003000460031007d000000 + {.8.1.4.D.2.2.E.3.-.F.0.D.B.-.4.9.8.4.-.9.8.3.F.-.B.C.3.2.6.9.6.B.E.0.F.1.}... + + 9223372036854776337 + + + {2e30c355-e9ed-49ce-a635-266a4440be9e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440045003400300036003700420035002d0044003000310044002d0034004600370046002d0039003500420039002d004200430041003500360045004100430041004600410041007d000000 + {.D.E.4.0.6.7.B.5.-.D.0.1.D.-.4.F.7.F.-.9.5.B.9.-.B.C.A.5.6.E.A.C.A.F.A.A.}... + + 9223372036854776338 + + + {a5a5784f-7482-4fb0-8f7d-d76ea07b5573} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300035003400460038004100420046002d0039003200330039002d0034003800460032002d0041004300450031002d003000360038003000310030003200420042004100430036007d000000 + {.0.5.4.F.8.A.B.F.-.9.2.3.9.-.4.8.F.2.-.A.C.E.1.-.0.6.8.0.1.0.2.B.B.A.C.6.}... + + 9223372036854776339 + + + {e5c91f00-cb28-4d70-8ef2-9351c595e63e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00420032004300330045003700330045002d0035004400390038002d0034004200330037002d0038004100440032002d004600410036003900300035003400350037003800320045007d000000 + {.B.2.C.3.E.7.3.E.-.5.D.9.8.-.4.B.3.7.-.8.A.D.2.-.F.A.6.9.0.5.4.5.7.8.2.E.}... + + 9223372036854776340 + + + {13e654d8-0311-4b2b-937c-1f01e46ffbb2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310046003500430043003400460036002d0030004100440042002d0034003200450044002d0042003500430043002d003100350045004200350045004200390030003100430034007d000000 + {.1.F.5.C.C.4.F.6.-.0.A.D.B.-.4.2.E.D.-.B.5.C.C.-.1.5.E.B.5.E.B.9.0.1.C.4.}... + + 9223372036854776341 + + + {df298d75-3e7f-4e8d-8b55-f56b4926c82f} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450034004500330044003300310033002d0038003500450033002d0034004300450030002d0041003100330030002d003500380035004400430039003600370041004400360036007d000000 + {.E.4.E.3.D.3.1.3.-.8.5.E.3.-.4.C.E.0.-.A.1.3.0.-.5.8.5.D.C.9.6.7.A.D.6.6.}... + + 9223372036854776342 + + + {9521e687-22a1-418f-bce2-7eb7fe25070a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00340033003000310042004300350039002d0032004100450045002d0034003500410038002d0039003600340038002d004600360031004200330035003400320030003500320046007d000000 + {.4.3.0.1.B.C.5.9.-.2.A.E.E.-.4.5.A.8.-.9.6.4.8.-.F.6.1.B.3.5.4.2.0.5.2.F.}... + + 9223372036854776343 + + + {db42024e-f9e7-4f03-b4c3-94fb3db7f934} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00390044003600420033003300320041002d0046003500320032002d0034003400430036002d0042003400380044002d003900430043004300340035003200330037003900380036007d000000 + {.9.D.6.B.3.3.2.A.-.F.5.2.2.-.4.4.C.6.-.B.4.8.D.-.9.C.C.C.4.5.2.3.7.9.8.6.}... + + 9223372036854776344 + + + {35f3ec13-352d-4b4d-80e7-0745db50321e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350041003300330032003700430037002d0033003500380035002d0034004600460043002d0039004200390042002d004100380044004400310037004400380031004600380033007d000000 + {.5.A.3.3.2.7.C.7.-.3.5.8.5.-.4.F.F.C.-.9.B.9.B.-.A.8.D.D.1.7.D.8.1.F.8.3.}... + + 9223372036854776345 + + + {0de8b3b5-a43a-4651-9397-f7a2a5c86ec6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00360038003900310046003600460036002d0032003500320035002d0034004600420032002d0039003300330045002d003900450046003000370046003300380033003300350044007d000000 + {.6.8.9.1.F.6.F.6.-.2.5.2.5.-.4.F.B.2.-.9.3.3.E.-.9.E.F.0.7.F.3.8.3.3.5.D.}... + + 9223372036854776346 + + + {23729a28-9e77-4000-a175-0d3ace63d138} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00330034003800390034003600390032002d0036003500380031002d0034003500440035002d0041004200450044002d003000440036003400350039003500360032004400320041007d000000 + {.3.4.8.9.4.6.9.2.-.6.5.8.1.-.4.5.D.5.-.A.B.E.D.-.0.D.6.4.5.9.5.6.2.D.2.A.}... + + 9223372036854776347 + + + {1588f8a1-b166-48f6-bef3-a2918b2b4b2e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440036004200430039003000420046002d0035004400340043002d0034003200420038002d0042004200380031002d004400330030004200350045003500390033003300300043007d000000 + {.D.6.B.C.9.0.B.F.-.5.D.4.C.-.4.2.B.8.-.B.B.8.1.-.D.3.0.B.5.E.5.9.3.3.0.C.}... + + 9223372036854776348 + + + {eeefb14f-6d56-4ad8-9a0d-6906e0f27143} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370036003900310046003900420034002d0031004400310031002d0034003900360030002d0038003800310045002d003400320030003100440045003100330031004100340034007d000000 + {.7.6.9.1.F.9.B.4.-.1.D.1.1.-.4.9.6.0.-.8.8.1.E.-.4.2.0.1.D.E.1.3.1.A.4.4.}... + + 9223372036854776349 + + + {ef018b97-7b72-4cdb-8f9e-6cda465099ad} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320042003100440036003200350045002d0041004500350039002d0034004300430037002d0039003500300044002d004200320035004400340046004600340043004100370039007d000000 + {.2.B.1.D.6.2.5.E.-.A.E.5.9.-.4.C.C.7.-.9.5.0.D.-.B.2.5.D.4.F.F.4.C.A.7.9.}... + + 9223372036854776350 + + + {70e5215e-c496-4954-a024-485e29f64ed1} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320030004400330039003200300030002d0034004600330044002d0034004300330037002d0039004500370035002d004600370037003400310032004500430045003900300036007d000000 + {.2.0.D.3.9.2.0.0.-.4.F.3.D.-.4.C.3.7.-.9.E.7.5.-.F.7.7.4.1.2.E.C.E.9.0.6.}... + + 9223372036854776351 + + + {57ca4bf8-eb85-4596-b0f5-93f3f457c9da} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00340031003500440041003600430045002d0035004500390041002d0034003400360032002d0039004100310046002d004400370039004600340037003700460031003900410035007d000000 + {.4.1.5.D.A.6.C.E.-.5.E.9.A.-.4.4.6.2.-.9.A.1.F.-.D.7.9.F.4.7.7.F.1.9.A.5.}... + + 9223372036854776352 + + + {4b3fce1f-7c65-4f21-9cb6-12610863dc49} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440037004100460035003800320034002d0042003100430044002d0034004300360037002d0042003100440033002d003800350044003500330038003800310041004100340039007d000000 + {.D.7.A.F.5.8.2.4.-.B.1.C.D.-.4.C.6.7.-.B.1.D.3.-.8.5.D.5.3.8.8.1.A.A.4.9.}... + + 9223372036854776353 + + + {a0789b38-a6a5-44c8-aee7-cb273954a2c0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430035003500330035004200370043002d0031003900390044002d0034003000380032002d0041003100380034002d004400430030003300350043003300430035003800390038007d000000 + {.C.5.5.3.5.B.7.C.-.1.9.9.D.-.4.0.8.2.-.A.1.8.4.-.D.C.0.3.5.C.3.C.5.8.9.8.}... + + 9223372036854776354 + + + {7954653e-00d4-493b-bf75-a7df7811caca} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00330032003000320037004200410041002d0046004400420044002d0034003200330030002d0041003900450035002d004100460034004600330037003200410037003400350042007d000000 + {.3.2.0.2.7.B.A.A.-.F.D.B.D.-.4.2.3.0.-.A.9.E.5.-.A.F.4.F.3.7.2.A.7.4.5.B.}... + + 9223372036854776355 + + + {986ffd0c-9682-4e34-93ee-18282e6fc7e4} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00410043003200410042003000430045002d0045004400390036002d0034003500350041002d0039003100430035002d003100440039004200430046004100330043003100380037007d000000 + {.A.C.2.A.B.0.C.E.-.E.D.9.6.-.4.5.5.A.-.9.1.C.5.-.1.D.9.B.C.F.A.3.C.1.8.7.}... + + 9223372036854776356 + + + {c4a200b8-5ef7-4b22-990c-3de8576a89c2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00460042003400320039004600380038002d0039003400340039002d0034004300440046002d0041003600390032002d003700450034003800440035003200450045004500460041007d000000 + {.F.B.4.2.9.F.8.8.-.9.4.4.9.-.4.C.D.F.-.A.6.9.2.-.7.E.4.8.D.5.2.E.E.E.F.A.}... + + 9223372036854776357 + + + {5504179a-041a-4796-902c-9d29d6461739} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350037003300300032004100430032002d0036003000460039002d0034003700410034002d0038003400330035002d004600420041004600450030003800300036004400320041007d000000 + {.5.7.3.0.2.A.C.2.-.6.0.F.9.-.4.7.A.4.-.8.4.3.5.-.F.B.A.F.E.0.8.0.6.D.2.A.}... + + 9223372036854776358 + + + {f8a49d92-f357-4994-8b2a-a3cbed9d995b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00420039003900340034004300370046002d0037003100390030002d0034004300340045002d0041004100380046002d004400370033003600460034004200370042003900340041007d000000 + {.B.9.9.4.4.C.7.F.-.7.1.9.0.-.4.C.4.E.-.A.A.8.F.-.D.7.3.6.F.4.B.7.B.9.4.A.}... + + 9223372036854776359 + + + {ccee2909-294e-4ad6-b0ef-fa93cdf3d2b5} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00340045003100450038003500330036002d0046004600450037002d0034003200420039002d0042003500340035002d003900380030004400330045003200300030003700300044007d000000 + {.4.E.1.E.8.5.3.6.-.F.F.E.7.-.4.2.B.9.-.B.5.4.5.-.9.8.0.D.3.E.2.0.0.7.0.D.}... + + 9223372036854776360 + + + {3aaefe3a-4f84-40da-a38a-319c198ac067} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00380042003100390046003900440034002d0033004200460045002d0034003900300030002d0041004200430033002d004400410039003100380037003600410044003400320043007d000000 + {.8.B.1.9.F.9.D.4.-.3.B.F.E.-.4.9.0.0.-.A.B.C.3.-.D.A.9.1.8.7.6.A.D.4.2.C.}... + + 9223372036854776361 + + + {2fceaed8-43de-431e-9e1c-248e4f8f43e1} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320041004400370033004500310035002d0041004400380041002d0034004500310037002d0042004200450030002d004200420038003200450039003600360046003900360045007d000000 + {.2.A.D.7.3.E.1.5.-.A.D.8.A.-.4.E.1.7.-.B.B.E.0.-.B.B.8.2.E.9.6.6.F.9.6.E.}... + + 9223372036854776362 + + + {a2ddf546-d32c-4a74-b522-12c269bee88f} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00390035003500410034003800350041002d0039004600300036002d0034004100360043002d0041003900360044002d004100330042003500430046003600390046004200350042007d000000 + {.9.5.5.A.4.8.5.A.-.9.F.0.6.-.4.A.6.C.-.A.9.6.D.-.A.3.B.5.C.F.6.9.F.B.5.B.}... + + 9223372036854776363 + + + {8852c503-6be2-4850-b366-41a3600b3c14} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370043003100330033003900300038002d0030003500330045002d0034003800350039002d0039004400360034002d004600300031003300440031004100410035003600300036007d000000 + {.7.C.1.3.3.9.0.8.-.0.5.3.E.-.4.8.5.9.-.9.D.6.4.-.F.0.1.3.D.1.A.A.5.6.0.6.}... + + 9223372036854776364 + + + {d02a7aa2-6454-4fd6-82fb-b198cef82a49} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430043003100410039004200390046002d0046004200420033002d0034003300300045002d0039004200350033002d004300380039003800420035003400380039003100430036007d000000 + {.C.C.1.A.9.B.9.F.-.F.B.B.3.-.4.3.0.E.-.9.B.5.3.-.C.8.9.8.B.5.4.8.9.1.C.6.}... + + 9223372036854776365 + + + {577bdf7b-b66e-4aa7-8c1e-0056a2312d4d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00360032003500340043003500440044002d0036004600430039002d0034003900460030002d0038004300350039002d003400350030004200440033004600320039003100390038007d000000 + {.6.2.5.4.C.5.D.D.-.6.F.C.9.-.4.9.F.0.-.8.C.5.9.-.4.5.0.B.D.3.F.2.9.1.9.8.}... + + 9223372036854776366 + + + {e972b787-cefb-4018-8a07-cb56fb335d05} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440043004200370044003300310041002d0043003600440030002d0034004500340037002d0042003300380034002d003200460039003400430030003400440030003300360034007d000000 + {.D.C.B.7.D.3.1.A.-.C.6.D.0.-.4.E.4.7.-.B.3.8.4.-.2.F.9.4.C.0.4.D.0.3.6.4.}... + + 9223372036854776367 + + + {a1c1ada8-14c5-436e-a4c1-9ed9a31cf907} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430037004200320036004100450043002d0038003800440044002d0034004300390030002d0039003100310043002d004100410037003500350031003500440039003600360041007d000000 + {.C.7.B.2.6.A.E.C.-.8.8.D.D.-.4.C.9.0.-.9.1.1.C.-.A.A.7.5.5.1.5.D.9.6.6.A.}... + + 9223372036854776368 + + + {000023c2-38de-4459-b661-d03163e40e3a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00360046004400350033003700420035002d0036004300330031002d0034003500380042002d0038003900310033002d003400440042004100440041003700430030003000340030007d000000 + {.6.F.D.5.3.7.B.5.-.6.C.3.1.-.4.5.8.B.-.8.9.1.3.-.4.D.B.A.D.A.7.C.0.0.4.0.}... + + 9223372036854776369 + + + {98008b68-29a7-4a99-ab26-95244c6f3f54} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320037003400320035004500360031002d0031003600450037002d0034003400370030002d0038004600410042002d003600440041004400430041004600320038003000380035007d000000 + {.2.7.4.2.5.E.6.1.-.1.6.E.7.-.4.4.7.0.-.8.F.A.B.-.6.D.A.D.C.A.F.2.8.0.8.5.}... + + 9223372036854776370 + + + {43241563-341c-4081-a5c8-5936cf234f41} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450030004400420037003000330041002d0036003800410045002d0034003200410045002d0042004600410035002d003200390036003400390039004200300033004200450031007d000000 + {.E.0.D.B.7.0.3.A.-.6.8.A.E.-.4.2.A.E.-.B.F.A.5.-.2.9.6.4.9.9.B.0.3.B.E.1.}... + + 9223372036854776371 + + + {447f6038-491e-4529-bc1e-a587cba618a3} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450041003900330032004500410041002d0036004300460043002d0034003200390042002d0042003700320035002d003000370044004100440033004400330035003000450044007d000000 + {.E.A.9.3.2.E.A.A.-.6.C.F.C.-.4.2.9.B.-.B.7.2.5.-.0.7.D.A.D.3.D.3.5.0.E.D.}... + + 9223372036854776372 + + + {5c41bff6-8bf5-48af-b42e-3b913be0d81f} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350031004200450041003600460041002d0042004400350033002d0034003200350038002d0041003600420035002d003500430044003400410044003300300031004600310033007d000000 + {.5.1.B.E.A.6.F.A.-.B.D.5.3.-.4.2.5.8.-.A.6.B.5.-.5.C.D.4.A.D.3.0.1.F.1.3.}... + + 9223372036854776373 + + + {978930af-c0d6-4296-ae53-cabba5589a56} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440035003500360034004100350046002d0039003800320038002d0034003600360031002d0039004600430043002d004200460045003200320039003200460043003300370033007d000000 + {.D.5.5.6.4.A.5.F.-.9.8.2.8.-.4.6.6.1.-.9.F.C.C.-.B.F.E.2.2.9.2.F.C.3.7.3.}... + + 9223372036854776374 + + + {848b440e-9599-4a74-b7d7-e85f5eabbee0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00330035003700410044004300300030002d0041003400450044002d0034004200370035002d0039003500460033002d003700410030003600370035004600440036003800320045007d000000 + {.3.5.7.A.D.C.0.0.-.A.4.E.D.-.4.B.7.5.-.9.5.F.3.-.7.A.0.6.7.5.F.D.6.8.2.E.}... + + 9223372036854776375 + + + {074dbf65-e26f-4e48-bcf6-2e6308011093} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00390045003900320033003700390041002d0031004600370044002d0034003400430044002d0042004400380046002d004400450041003400300033003600360031003000330045007d000000 + {.9.E.9.2.3.7.9.A.-.1.F.7.D.-.4.4.C.D.-.B.D.8.F.-.D.E.A.4.0.3.6.6.1.0.3.E.}... + + 9223372036854776376 + + + {8ebcef68-f34d-4139-8b85-7b57334b9329} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310037003100350031003900310046002d0035003100450038002d0034003900320046002d0038003800460044002d004500440043003000330044003500370045004600370042007d000000 + {.1.7.1.5.1.9.1.F.-.5.1.E.8.-.4.9.2.F.-.8.8.F.D.-.E.D.C.0.3.D.5.7.E.F.7.B.}... + + 9223372036854776377 + + + {152c9c3b-b07e-486e-a750-7d561d75f843} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450043003600410039003600330039002d0035003300360035002d0034003600430041002d0042004400460042002d004500350041004100300039003300420035004200460045007d000000 + {.E.C.6.A.9.6.3.9.-.5.3.6.5.-.4.6.C.A.-.B.D.F.B.-.E.5.A.A.0.9.3.B.5.B.F.E.}... + + 9223372036854776378 + + + {4c37bb57-9bdf-4ab2-891f-cccdbc2b0d0c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440041003600320046003000300041002d0041003000350034002d0034004600420032002d0038004600370033002d003100370031004100370034003900360045003500360036007d000000 + {.D.A.6.2.F.0.0.A.-.A.0.5.4.-.4.F.B.2.-.8.F.7.3.-.1.7.1.A.7.4.9.6.E.5.6.6.}... + + 9223372036854776379 + + + {6f3f53ac-3323-445c-9236-0794fb401551} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440042004300410038003200380035002d0035003400330042002d0034003000330035002d0042003900330035002d004200390039004500320033003100350037003500360031007d000000 + {.D.B.C.A.8.2.8.5.-.5.4.3.B.-.4.0.3.5.-.B.9.3.5.-.B.9.9.E.2.3.1.5.7.5.6.1.}... + + 9223372036854776380 + + + {02438bea-ea89-467b-95c8-818ba1d1c792} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300039003200340033003100330033002d0033004400350041002d0034004500340034002d0041003800310041002d003700440030003100330034004300300031003800440030007d000000 + {.0.9.2.4.3.1.3.3.-.3.D.5.A.-.4.E.4.4.-.A.8.1.A.-.7.D.0.1.3.4.C.0.1.8.D.0.}... + + 9223372036854776381 + + + {86b5cc90-9f68-470a-b4ea-a0649192dc04} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00330033003100430046004600440038002d0046003100320041002d0034004200410044002d0041004200410043002d004100410039004100300035003500460041003800370037007d000000 + {.3.3.1.C.F.F.D.8.-.F.1.2.A.-.4.B.A.D.-.A.B.A.C.-.A.A.9.A.0.5.5.F.A.8.7.7.}... + + 9223372036854776382 + + + {c7e71c4d-4300-492f-9531-78b23a4270af} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00340034003100360030004200370037002d0042003100340043002d0034003100380042002d0041004600420037002d003500350034004200330032003900420034003600310041007d000000 + {.4.4.1.6.0.B.7.7.-.B.1.4.C.-.4.1.8.B.-.A.F.B.7.-.5.5.4.B.3.2.9.B.4.6.1.A.}... + + 9223372036854776383 + + + {ba1eb0dc-09b8-4985-9a99-40696b5eb363} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300038004600420044003100370037002d0046003100330033002d0034003500390036002d0042003800380037002d003200430042004600420042003900440044003300420032007d000000 + {.0.8.F.B.D.1.7.7.-.F.1.3.3.-.4.5.9.6.-.B.8.8.7.-.2.C.B.F.B.B.9.D.D.3.B.2.}... + + 9223372036854776384 + + + {bdfe501c-4d70-448d-939f-01ee41bd1d51} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440039004100370033003800330034002d0038004100310037002d0034004400370043002d0042003600460034002d003500330038004300350032003000450033004100440036007d000000 + {.D.9.A.7.3.8.3.4.-.8.A.1.7.-.4.D.7.C.-.B.6.F.4.-.5.3.8.C.5.2.0.E.3.A.D.6.}... + + 9223372036854776385 + + + {84f429fe-9e92-4f64-9e85-1638507af4bb} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430042004300370037003300320035002d0044003300420032002d0034003300350032002d0039004300380043002d004300350034003300330036003800460032003100330030007d000000 + {.C.B.C.7.7.3.2.5.-.D.3.B.2.-.4.3.5.2.-.9.C.8.C.-.C.5.4.3.3.6.8.F.2.1.3.0.}... + + 9223372036854776386 + + + {c517f12a-4314-4b91-a3e3-cffa9ba1151c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00360032004300430045004500330042002d0035003800300030002d0034004500430036002d0038003200450041002d003700330035003300330030004400320033004100370041007d000000 + {.6.2.C.C.E.E.3.B.-.5.8.0.0.-.4.E.C.6.-.8.2.E.A.-.7.3.5.3.3.0.D.2.3.A.7.A.}... + + 9223372036854776387 + + + {4e4daac0-5ff3-4fd0-b89b-8515c76d2b39} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350035004100360038003800460033002d0037004300410032002d0034004300330038002d0042004600300035002d004200350035004300340042003900390041004500330030007d000000 + {.5.5.A.6.8.8.F.3.-.7.C.A.2.-.4.C.3.8.-.B.F.0.5.-.B.5.5.C.4.B.9.9.A.E.3.0.}... + + 9223372036854776388 + + + {2cbac533-c29f-4914-9c3d-39c8c547a017} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440038003800330041003700450039002d0037003600420031002d0034003000350041002d0042003900380034002d003800430033003600360032003200450033004600310036007d000000 + {.D.8.8.3.A.7.E.9.-.7.6.B.1.-.4.0.5.A.-.B.9.8.4.-.8.C.3.6.6.2.2.E.3.F.1.6.}... + + 9223372036854776389 + + + {b09b0efc-578d-48b1-ab44-ad43ae7e0180} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300042004200300036003800340038002d0031004100450035002d0034004600310041002d0042003100310041002d004500380030003600360035003900420041003900370037007d000000 + {.0.B.B.0.6.8.4.8.-.1.A.E.5.-.4.F.1.A.-.B.1.1.A.-.E.8.0.6.6.5.9.B.A.9.7.7.}... + + 9223372036854776390 + + + {df4b6bcf-364f-4b59-be2e-708a2cf34736} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440032003200380042003800430043002d0037003700320043002d0034003000420046002d0041004100460046002d003700370042003600360031003500450039003300310033007d000000 + {.D.2.2.8.B.8.C.C.-.7.7.2.C.-.4.0.B.F.-.A.A.F.F.-.7.7.B.6.6.1.5.E.9.3.1.3.}... + + 9223372036854776391 + + + {f1e8ead7-7365-4b62-98e0-07d8c7a70f69} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440032003400340033003300320041002d0038003100320044002d0034004600350045002d0039004300390045002d004400330035004500300032003100300044003900450034007d000000 + {.D.2.4.4.3.3.2.A.-.8.1.2.D.-.4.F.5.E.-.9.C.9.E.-.D.3.5.E.0.2.1.0.D.9.E.4.}... + + 9223372036854776392 + + + {54c215ee-3737-4395-b870-3c39a92d6e14} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00380034003900460036003100310038002d0037003000430038002d0034003100370036002d0039004300450033002d004100390037003600320042004100300034003500460034007d000000 + {.8.4.9.F.6.1.1.8.-.7.0.C.8.-.4.1.7.6.-.9.C.E.3.-.A.9.7.6.2.B.A.0.4.5.F.4.}... + + 9223372036854776393 + + + {dc9e7dac-335e-4ac9-86c7-4ec827dfa623} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00360039003000390044004400360038002d0030004200390034002d0034003400330038002d0042003200450034002d003000450043003000450043003500340039004400430035007d000000 + {.6.9.0.9.D.D.6.8.-.0.B.9.4.-.4.4.3.8.-.B.2.E.4.-.0.E.C.0.E.C.5.4.9.D.C.5.}... + + 9223372036854776394 + + + {e34c6afe-4306-4659-93f3-4d97ec7172c6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00410046004500320030003100380033002d0035003900310031002d0034003900380042002d0038004200320030002d003500420031004100440032003400430044003200330031007d000000 + {.A.F.E.2.0.1.8.3.-.5.9.1.1.-.4.9.8.B.-.8.B.2.0.-.5.B.1.A.D.2.4.C.D.2.3.1.}... + + 9223372036854776395 + + + {f2910211-63cc-46f9-b8e7-cd75d195b804} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00330038004300450046003000410033002d0039004100310032002d0034004400310042002d0042003400430046002d003200460043003300330041003500350031003500380046007d000000 + {.3.8.C.E.F.0.A.3.-.9.A.1.2.-.4.D.1.B.-.B.4.C.F.-.2.F.C.3.3.A.5.5.1.5.8.F.}... + + 9223372036854776396 + + + {34d3c4b0-f3dd-408d-8f06-aef15eb33e99} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300039003000310043004600320035002d0031003600430030002d0034004200360034002d0039003000390032002d003000390039003400370034004300350044003000450042007d000000 + {.0.9.0.1.C.F.2.5.-.1.6.C.0.-.4.B.6.4.-.9.0.9.2.-.0.9.9.4.7.4.C.5.D.0.E.B.}... + + 9223372036854776397 + + + {6256af2d-05dd-4bbd-81b0-b65cf3505cc7} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350035003600300039003000390031002d0033004600350043002d0034003500410031002d0041004600420038002d004500340032003300460046003700350043004200300035007d000000 + {.5.5.6.0.9.0.9.1.-.3.F.5.C.-.4.5.A.1.-.A.F.B.8.-.E.4.2.3.F.F.7.5.C.B.0.5.}... + + 9223372036854776398 + + + {b656da4a-de0d-4d0e-8f93-4273211ec8de} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300032004400390038003000390036002d0039004100380031002d0034004600370034002d0042003900310046002d004600300042004400450030004400430034003100460041007d000000 + {.0.2.D.9.8.0.9.6.-.9.A.8.1.-.4.F.7.4.-.B.9.1.F.-.F.0.B.D.E.0.D.C.4.1.F.A.}... + + 9223372036854776399 + + + {db9854c8-9f5a-4731-a881-ac02fa59715d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00360032003500460030003500450038002d0045003000360046002d0034003500460035002d0042003300380036002d003700330044003000430043003500320034004100440041007d000000 + {.6.2.5.F.0.5.E.8.-.E.0.6.F.-.4.5.F.5.-.B.3.8.6.-.7.3.D.0.C.C.5.2.4.A.D.A.}... + + 9223372036854776400 + + + {278afac0-96f3-483f-b065-daf09e88e006} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00380030003000460046003400330045002d0035004400320030002d0034004100320034002d0041003600450045002d003000450033004200320035003600320038003600310030007d000000 + {.8.0.0.F.F.4.3.E.-.5.D.2.0.-.4.A.2.4.-.A.6.E.E.-.0.E.3.B.2.5.6.2.8.6.1.0.}... + + 9223372036854776401 + + + {83ff194c-2394-4712-bf17-d5ec5c46f605} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300032003100390031003700360042002d0037004300340030002d0034003400320043002d0042003000370033002d003400450045003600450042004300300032004100300043007d000000 + {.0.2.1.9.1.7.6.B.-.7.C.4.0.-.4.4.2.C.-.B.0.7.3.-.4.E.E.6.E.B.C.0.2.A.0.C.}... + + 9223372036854776402 + + + {d44012ee-bfc1-40ec-8efe-d82a7572b0f4} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00410037004100310046003400340031002d0030003800360031002d0034003500320036002d0041004300310039002d004300300045004600410039003100330033003300430034007d000000 + {.A.7.A.1.F.4.4.1.-.0.8.6.1.-.4.5.2.6.-.A.C.1.9.-.C.0.E.F.A.9.1.3.3.3.C.4.}... + + 9223372036854776403 + + + {6cc13dd8-dd41-4153-9f2c-b73d772dbef3} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300030003600360030003200300039002d0039003000340039002d0034004300450033002d0038003100450030002d004200320039004300300031004400310035003900460043007d000000 + {.0.0.6.6.0.2.0.9.-.9.0.4.9.-.4.C.E.3.-.8.1.E.0.-.B.2.9.C.0.1.D.1.5.9.F.C.}... + + 9223372036854776404 + + + {ff24c069-f535-479a-8c11-f081dd0ac319} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320033003600450033003900320033002d0039003200320032002d0034003000330035002d0038003500410046002d003100390031003100410035004200380042003900340035007d000000 + {.2.3.6.E.3.9.2.3.-.9.2.2.2.-.4.0.3.5.-.8.5.A.F.-.1.9.1.1.A.5.B.8.B.9.4.5.}... + + 9223372036854776405 + + + {4d5c2e53-a292-49ca-a085-a5576bb43cbf} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310031004600430030003200420045002d0030004100410037002d0034003300330043002d0041003700430033002d004500310046004100360037004200340046004300410034007d000000 + {.1.1.F.C.0.2.B.E.-.0.A.A.7.-.4.3.3.C.-.A.7.C.3.-.E.1.F.A.6.7.B.4.F.C.A.4.}... + + 9223372036854776406 + + + {10fff4e2-b1f1-4ad9-8621-d8312897f70d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370035003500380031004100380039002d0030003600300032002d0034004300380044002d0038003000310030002d003600440044003300340036003100440035003500330045007d000000 + {.7.5.5.8.1.A.8.9.-.0.6.0.2.-.4.C.8.D.-.8.0.1.0.-.6.D.D.3.4.6.1.D.5.5.3.E.}... + + 9223372036854776407 + + + {368c1f37-db34-4e36-ae3e-1a894777a379} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440043004600330045003900310032002d0036003600390035002d0034004100430039002d0038004100430039002d003700390033003300340038003200430039003400330037007d000000 + {.D.C.F.3.E.9.1.2.-.6.6.9.5.-.4.A.C.9.-.8.A.C.9.-.7.9.3.3.4.8.2.C.9.4.3.7.}... + + 9223372036854776408 + + + {488dae1d-fa1e-404f-a365-32b5f9a97209} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430033003600420031003000370036002d0034003700450043002d0034004200450045002d0039003500300037002d004500300035004500330041003400360036004300340045007d000000 + {.C.3.6.B.1.0.7.6.-.4.7.E.C.-.4.B.E.E.-.9.5.0.7.-.E.0.5.E.3.A.4.6.6.C.4.E.}... + + 9223372036854776411 + + + {6f8faa8d-e741-4380-a25e-079570bee209} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430038003300330037003200310044002d0039003500300034002d0034004400310041002d0039003900340042002d004500360036003300380043004200320041003500370045007d000000 + {.C.8.3.3.7.2.1.D.-.9.5.0.4.-.4.D.1.A.-.9.9.4.B.-.E.6.6.3.8.C.B.2.A.5.7.E.}... + + 9223372036854776412 + + + {7252f45c-99e4-4b10-a885-6e89864ddbdf} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440030004400460045003600420034002d0037003700350042002d0034003200360037002d0041003300340035002d003700390033004300440034003300340043003900410041007d000000 + {.D.0.D.F.E.6.B.4.-.7.7.5.B.-.4.2.6.7.-.A.3.4.5.-.7.9.3.C.D.4.3.4.C.9.A.A.}... + + 9223372036854776413 + + + {cc263db7-a803-4ddc-915b-c28786aa1106} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430042003200430043004500370033002d0033003300380045002d0034003400410045002d0038003600350044002d003100370039003400420041004100460039003300430044007d000000 + {.C.B.2.C.C.E.7.3.-.3.3.8.E.-.4.4.A.E.-.8.6.5.D.-.1.7.9.4.B.A.A.F.9.3.C.D.}... + + 9223372036854776414 + + + {41d435c4-374c-4379-81c5-e77b5ac3b000} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00340034004500450037003200430034002d0032003300450035002d0034004100340030002d0042003900340033002d003900310044004300450036003000310043003600420045007d000000 + {.4.4.E.E.7.2.C.4.-.2.3.E.5.-.4.A.4.0.-.B.9.4.3.-.9.1.D.C.E.6.0.1.C.6.B.E.}... + + 9223372036854776415 + + + {61b04769-24ce-41d7-a0db-551604ba286c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300046003800460043003500310032002d0038003100410034002d0034003600410038002d0039003300390036002d004400440041004500420036004300350046004200370034007d000000 + {.0.F.8.F.C.5.1.2.-.8.1.A.4.-.4.6.A.8.-.9.3.9.6.-.D.D.A.E.B.6.C.5.F.B.7.4.}... + + 9223372036854776416 + + + {ea99112d-7c47-468c-97a2-0f8d8b8d9434} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00420038004300450030003900440031002d0044003800390033002d0034003200340042002d0039003500370045002d003900360030004600350035004400460036003400370041007d000000 + {.B.8.C.E.0.9.D.1.-.D.8.9.3.-.4.2.4.B.-.9.5.7.E.-.9.6.0.F.5.5.D.F.6.4.7.A.}... + + 9223372036854776417 + + + {cce03e11-69e7-4526-b635-6c4d3d4d9e60} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320045003000320042003700450034002d0034004300320038002d0034004300460045002d0038003000360036002d003600350039003800440046003400410039003700300041007d000000 + {.2.E.0.2.B.7.E.4.-.4.C.2.8.-.4.C.F.E.-.8.0.6.6.-.6.5.9.8.D.F.4.A.9.7.0.A.}... + + 9223372036854776418 + + + {9e93f20a-fa57-4f9e-a74e-b92fb120b2cd} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350035003100350042004500420044002d0031003600430043002d0034003800420037002d0042003500430044002d003000440036003200320038003900360035004300380032007d000000 + {.5.5.1.5.B.E.B.D.-.1.6.C.C.-.4.8.B.7.-.B.5.C.D.-.0.D.6.2.2.8.9.6.5.C.8.2.}... + + 9223372036854776419 + + + {d7494c94-88e8-4e5e-9a7a-b5ceda82fff6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430034003600380031003400350034002d0036004200330038002d0034003700360037002d0038003500440045002d004600340037004400420039004500310046004600310039007d000000 + {.C.4.6.8.1.4.5.4.-.6.B.3.8.-.4.7.6.7.-.8.5.D.E.-.F.4.7.D.B.9.E.1.F.F.1.9.}... + + 9223372036854776420 + + + {39b3a2c0-9c09-4442-b2f2-43214a54b45a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450035004600460033003900460030002d0045004100370032002d0034003300440031002d0042004100410044002d003500390031003700330039004300330043003300380039007d000000 + {.E.5.F.F.3.9.F.0.-.E.A.7.2.-.4.3.D.1.-.B.A.A.D.-.5.9.1.7.3.9.C.3.C.3.8.9.}... + + 9223372036854776421 + + + {2baa143c-6dbe-49e8-9267-5cc0059ed12d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350044004600460036004500300030002d0044003800310041002d0034004300460035002d0041003300410034002d003800320045003600360033003600380036004100360041007d000000 + {.5.D.F.F.6.E.0.0.-.D.8.1.A.-.4.C.F.5.-.A.3.A.4.-.8.2.E.6.6.3.6.8.6.A.6.A.}... + + 9223372036854776422 + + + {26af65c1-8005-4cf0-ada0-9aa571a1365e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00380035003200380031004100330031002d0034004100420033002d0034003100310032002d0039004100390037002d004300430038003700390045003900430044003500440039007d000000 + {.8.5.2.8.1.A.3.1.-.4.A.B.3.-.4.1.1.2.-.9.A.9.7.-.C.C.8.7.9.E.9.C.D.5.D.9.}... + + 9223372036854776423 + + + {ea23c737-f8b8-4a7d-ab55-3396e8d029f2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440043003500430044003200380046002d0039004300350044002d0034004300300042002d0041003100370043002d003100300045003800390030004200450037004100390043007d000000 + {.D.C.5.C.D.2.8.F.-.9.C.5.D.-.4.C.0.B.-.A.1.7.C.-.1.0.E.8.9.0.B.E.7.A.9.C.}... + + 9223372036854776424 + + + {bff5e1d1-5465-49b3-b3c6-c812334ae432} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370039004200450034003500330045002d0031003300340031002d0034004200320045002d0039003000460031002d004300370044003300300033003500350038003900450041007d000000 + {.7.9.B.E.4.5.3.E.-.1.3.4.1.-.4.B.2.E.-.9.0.F.1.-.C.7.D.3.0.3.5.5.8.9.E.A.}... + + 9223372036854776425 + + + {a7a81b7f-2287-4d4a-b34e-eafa46a56fed} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00410036004200430039004300340030002d0034003400390041002d0034003100340043002d0038003200310038002d003700390042004100330044004200410038003000390043007d000000 + {.A.6.B.C.9.C.4.0.-.4.4.9.A.-.4.1.4.C.-.8.2.1.8.-.7.9.B.A.3.D.B.A.8.0.9.C.}... + + 9223372036854776426 + + + {0dfc39e6-df49-4ff4-ad33-a67704cd209b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00410041003400310039004300440038002d0033003800440030002d0034003800390036002d0039004200350030002d003100350046003600300037003700440032003600370032007d000000 + {.A.A.4.1.9.C.D.8.-.3.8.D.0.-.4.8.9.6.-.9.B.5.0.-.1.5.F.6.0.7.7.D.2.6.7.2.}... + + 9223372036854776427 + + + {e014bc02-d4a9-413d-8213-199172a7df9e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00330043003900350045003100460041002d0046004400370038002d0034004400320042002d0038004200430041002d003000420045004400420038004500460035003300350034007d000000 + {.3.C.9.5.E.1.F.A.-.F.D.7.8.-.4.D.2.B.-.8.B.C.A.-.0.B.E.D.B.8.E.F.5.3.5.4.}... + + 9223372036854776428 + + + {21f5906e-61ef-4d15-87b2-89f4786ec5d0} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300036003800450035004300340033002d0042003800390042002d0034003200350041002d0039003700430039002d003300310036003100390041003300410038004400440030007d000000 + {.0.6.8.E.5.C.4.3.-.B.8.9.B.-.4.2.5.A.-.9.7.C.9.-.3.1.6.1.9.A.3.A.8.D.D.0.}... + + 9223372036854776429 + + + {a6088cfc-cd47-4787-b825-f9182c0e5bfe} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00380044003000430035004600310043002d0033003400440032002d0034003700450046002d0042004200340043002d003500330043004400350046003000300031003900310045007d000000 + {.8.D.0.C.5.F.1.C.-.3.4.D.2.-.4.7.E.F.-.B.B.4.C.-.5.3.C.D.5.F.0.0.1.9.1.E.}... + + 9223372036854776430 + + + {816e87d6-82f6-4a64-8f51-5ce17e19ce41} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350042003000460030004500440045002d0031003000430046002d0034003900440036002d0041003300440033002d003800360036004300320031003800420038003400300046007d000000 + {.5.B.0.F.0.E.D.E.-.1.0.C.F.-.4.9.D.6.-.A.3.D.3.-.8.6.6.C.2.1.8.B.8.4.0.F.}... + + 9223372036854776431 + + + {ddb485c7-523d-473e-aa7c-006050a20609} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00460039003000410039003400460044002d0038003700390045002d0034004100380035002d0041003200300036002d004400320037004600360034003000330039003200350038007d000000 + {.F.9.0.A.9.4.F.D.-.8.7.9.E.-.4.A.8.5.-.A.2.0.6.-.D.2.7.F.6.4.0.3.9.2.5.8.}... + + 9223372036854776432 + + + {aab2b3fd-6d4d-4a30-8f5d-4562010bd49e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00420032003800410046003000450035002d0044003000420037002d0034003800420036002d0039004500300030002d003300430031003100320030004600430043004300460034007d000000 + {.B.2.8.A.F.0.E.5.-.D.0.B.7.-.4.8.B.6.-.9.E.0.0.-.3.C.1.1.2.0.F.C.C.C.F.4.}... + + 9223372036854776433 + + + {5f3612b3-d154-4a81-a87f-9812b69d879f} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320034003100380043004400430037002d0033003100410036002d0034003400310044002d0038004500390034002d003200430030003800310033003300430034003500340041007d000000 + {.2.4.1.8.C.D.C.7.-.3.1.A.6.-.4.4.1.D.-.8.E.9.4.-.2.C.0.8.1.3.3.C.4.5.4.A.}... + + 9223372036854776434 + + + {abb7f935-dc63-46d8-b66c-f0cc5c1e5280} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00390033004200440033004100370031002d0031003000320036002d0034003600450031002d0041004100320032002d003700360030004100460035003500430038004200320034007d000000 + {.9.3.B.D.3.A.7.1.-.1.0.2.6.-.4.6.E.1.-.A.A.2.2.-.7.6.0.A.F.5.5.C.8.B.2.4.}... + + 9223372036854776435 + + + {54883c72-078c-4ac9-ba34-a84418454eca} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310046003100300039004300340033002d0035003900310038002d0034004600460043002d0039003600410030002d004600310039003900450033003500420043003200410032007d000000 + {.1.F.1.0.9.C.4.3.-.5.9.1.8.-.4.F.F.C.-.9.6.A.0.-.F.1.9.9.E.3.5.B.C.2.A.2.}... + + 9223372036854776436 + + + {70e256b2-922a-432a-9f93-0da28403e285} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310037004200340039003100450032002d0042004600310034002d0034004100380033002d0042003300450037002d004300390039004200390044003700390039003800340036007d000000 + {.1.7.B.4.9.1.E.2.-.B.F.1.4.-.4.A.8.3.-.B.3.E.7.-.C.9.9.B.9.D.7.9.9.8.4.6.}... + + 9223372036854776439 + + + {768024ef-bdcf-4652-87ba-6bab3d4c5188} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450039004500420045003000310038002d0041003000300034002d0034004100320030002d0039003400450036002d003500350036004600450030003400440038003600340044007d000000 + {.E.9.E.B.E.0.1.8.-.A.0.0.4.-.4.A.2.0.-.9.4.E.6.-.5.5.6.F.E.0.4.D.8.6.4.D.}... + + 9223372036854776440 + + + {3b994b2a-f242-4c76-855c-03b815f2060b} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450038003900360042003900450042002d0037003900420041002d0034003700430043002d0039003000390045002d003800410038003900420039004200370044003200370037007d000000 + {.E.8.9.6.B.9.E.B.-.7.9.B.A.-.4.7.C.C.-.9.0.9.E.-.8.A.8.9.B.9.B.7.D.2.7.7.}... + + 9223372036854776441 + + + {6df8b345-0230-43d9-8d8e-12dc278a5da6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300034003300330035004500380033002d0036004400330044002d0034003400380039002d0041003800420044002d003400360031004500300031003200390046004300450036007d000000 + {.0.4.3.3.5.E.8.3.-.6.D.3.D.-.4.4.8.9.-.A.8.B.D.-.4.6.1.E.0.1.2.9.F.C.E.6.}... + + 9223372036854776442 + + + {f24769c1-3640-4f68-afde-76aa79179219} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00340031004100320034003700320045002d0046004600440036002d0034003600450032002d0041003000330035002d004300430038004600450031003000300034004500410038007d000000 + {.4.1.A.2.4.7.2.E.-.F.F.D.6.-.4.6.E.2.-.A.0.3.5.-.C.C.8.F.E.1.0.0.4.E.A.8.}... + + 9223372036854776443 + + + {aefe901c-5a83-4e4c-9d5e-178ff2082943} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00380046003100310042003900390034002d0044003100390031002d0034003000340038002d0042003900430042002d003000460044003500380045003600330030003600390036007d000000 + {.8.F.1.1.B.9.9.4.-.D.1.9.1.-.4.0.4.8.-.B.9.C.B.-.0.F.D.5.8.E.6.3.0.6.9.6.}... + + 9223372036854776444 + + + {78518afb-c587-4564-a904-4e6be35bf900} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00390044003400440034004500370032002d0038004600350044002d0034003000340041002d0039003400380036002d003400420035003400320039004600460035003800330031007d000000 + {.9.D.4.D.4.E.7.2.-.8.F.5.D.-.4.0.4.A.-.9.4.8.6.-.4.B.5.4.2.9.F.F.5.8.3.1.}... + + 9223372036854776445 + + + {95555d1b-c7d8-4915-b994-00260f75e514} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310038003400440030003600440041002d0044003100370037002d0034004600450045002d0041004300460032002d003900350042003700380032004100420035003900390046007d000000 + {.1.8.4.D.0.6.D.A.-.D.1.7.7.-.4.F.E.E.-.A.C.F.2.-.9.5.B.7.8.2.A.B.5.9.9.F.}... + + 9223372036854776446 + + + {0b587fb8-2b5d-4186-84ca-ff54e76304fa} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00340046003200340043004200390039002d0034003900430038002d0034004300340036002d0038003200350042002d004400370031004100390037003800360043004200440034007d000000 + {.4.F.2.4.C.B.9.9.-.4.9.C.8.-.4.C.4.6.-.8.2.5.B.-.D.7.1.A.9.7.8.6.C.B.D.4.}... + + 9223372036854776447 + + + {805b81fa-6d7a-43a3-91c1-f13f1a1a9162} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450034004500380046003900330036002d0043004600380036002d0034003200410036002d0039003900450031002d003400370045004200390033003400380042003700420030007d000000 + {.E.4.E.8.F.9.3.6.-.C.F.8.6.-.4.2.A.6.-.9.9.E.1.-.4.7.E.B.9.3.4.8.B.7.B.0.}... + + 9223372036854776448 + + + {4069af0d-2fc4-448f-807f-9c6876d0a3ea} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00390041003500440033003800450041002d0046003300350043002d0034003100380043002d0041003700310033002d003300340044003000360031004500360033003500420046007d000000 + {.9.A.5.D.3.8.E.A.-.F.3.5.C.-.4.1.8.C.-.A.7.1.3.-.3.4.D.0.6.1.E.6.3.5.B.F.}... + + 9223372036854776449 + + + {a5bfc811-4153-4f33-8718-d8f4522e2091} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00390038003700360044003800450035002d0046003300310035002d0034004500460043002d0039004500440043002d003800420039003300410046003100360031004300330045007d000000 + {.9.8.7.6.D.8.E.5.-.F.3.1.5.-.4.E.F.C.-.9.E.D.C.-.8.B.9.3.A.F.1.6.1.C.3.E.}... + + 9223372036854776450 + + + {1a89d52d-bdc9-4413-bd14-8e6e834da99c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00350041003900440046004100340039002d0039004100350030002d0034003400450036002d0038004400460046002d004100460039003500450032004500430038004400390032007d000000 + {.5.A.9.D.F.A.4.9.-.9.A.5.0.-.4.4.E.6.-.8.D.F.F.-.A.F.9.5.E.2.E.C.8.D.9.2.}... + + 9223372036854776451 + + + {804b6c1e-62a6-440e-a4e1-45fd8949dce6} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430043004100300043003400320032002d0037003400310041002d0034004500350044002d0038004100300045002d003300360038003700350041004300440036003100420038007d000000 + {.C.C.A.0.C.4.2.2.-.7.4.1.A.-.4.E.5.D.-.8.A.0.E.-.3.6.8.7.5.A.C.D.6.1.B.8.}... + + 9223372036854776452 + + + {c99679ae-a6f8-497d-b6eb-94821d27a44d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440038004600430033003500310035002d0043003200360037002d0034003700420042002d0039003700430045002d003900330032003000300035003800300043003600330045007d000000 + {.D.8.F.C.3.5.1.5.-.C.2.6.7.-.4.7.B.B.-.9.7.C.E.-.9.3.2.0.0.5.8.0.C.6.3.E.}... + + 9223372036854776453 + + + {221b7254-8807-42ab-bfa5-0cd2dbd0f0d5} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440046003100340037003300440037002d0030003800330033002d0034003500300042002d0039003900310041002d003100420039003800380044003300300038004400360039007d000000 + {.D.F.1.4.7.3.D.7.-.0.8.3.3.-.4.5.0.B.-.9.9.1.A.-.1.B.9.8.8.D.3.0.8.D.6.9.}... + + 9223372036854776454 + + + {0f24b893-b964-4d88-8875-d462390251e5} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450038003900360034004100340044002d0045003800380046002d0034003400330043002d0042003600360046002d004300420037003000450039003700410036004200380038007d000000 + {.E.8.9.6.4.A.4.D.-.E.8.8.F.-.4.4.3.C.-.B.6.6.F.-.C.B.7.0.E.9.7.A.6.B.8.8.}... + + 9223372036854776455 + + + {c8e8b63f-05ac-4b2c-858a-d3b66b9bca94} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300038003400420039004500320036002d0046003900320046002d0034003100350039002d0042003700370043002d003000460046003900410032003600360046004400390041007d000000 + {.0.8.4.B.9.E.2.6.-.F.9.2.F.-.4.1.5.9.-.B.7.7.C.-.0.F.F.9.A.2.6.6.F.D.9.A.}... + + 9223372036854776456 + + + {934834f5-e0a5-441b-85c2-73fd9be9463f} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370045004600430031003900320033002d0038003000460042002d0034003900440046002d0042003000430033002d004100350033004400430038003800450033004300430030007d000000 + {.7.E.F.C.1.9.2.3.-.8.0.F.B.-.4.9.D.F.-.B.0.C.3.-.A.5.3.D.C.8.8.E.3.C.C.0.}... + + 9223372036854776457 + + + {f0e85dc1-2a2a-4fc0-b501-a30cbac74a8e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450044004200330043004400310045002d0042004600370041002d0034003500440036002d0041003800390034002d003300340046003300360039003400370034003400380041007d000000 + {.E.D.B.3.C.D.1.E.-.B.F.7.A.-.4.5.D.6.-.A.8.9.4.-.3.4.F.3.6.9.4.7.4.4.8.A.}... + + 9223372036854776458 + + + {09a98b8a-115e-495c-836b-42b475630183} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00450030004400420042004100410031002d0043004200330035002d0034003100450037002d0039003900350043002d003300370041004200360043003500380035003400300038007d000000 + {.E.0.D.B.B.A.A.1.-.C.B.3.5.-.4.1.E.7.-.9.9.5.C.-.3.7.A.B.6.C.5.8.5.4.0.8.}... + + 9223372036854776461 + + + {400124d1-e3bc-4c21-84f1-9c2fdd660eaa} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00390031003000440039003100450031002d0032003900320038002d0034003600420032002d0038003600450046002d003600410045003100460032004400380045003200410043007d000000 + {.9.1.0.D.9.1.E.1.-.2.9.2.8.-.4.6.B.2.-.8.6.E.F.-.6.A.E.1.F.2.D.8.E.2.A.C.}... + + 9223372036854776462 + + + {f9f5ba6c-d936-4b6f-9503-aa2fc28d2bb8} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440046004400410045004600310031002d0046004100420043002d0034003400460031002d0039003400450036002d003300440043003600320035003800460038003500420036007d000000 + {.D.F.D.A.E.F.1.1.-.F.A.B.C.-.4.4.F.1.-.9.4.E.6.-.3.D.C.6.2.5.8.F.8.5.B.6.}... + + 9223372036854776463 + + + {fbb9b711-0218-4bd3-bc24-5f88cdd9fcec} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310034003400450038003900370032002d0030004500310030002d0034003600350033002d0038004400440032002d003600420031003400350038003000440046004600300046007d000000 + {.1.4.4.E.8.9.7.2.-.0.E.1.0.-.4.6.5.3.-.8.D.D.2.-.6.B.1.4.5.8.0.D.F.F.0.F.}... + + 9223372036854776464 + + + {60847319-40c2-4c6b-9b63-67b1fdef219d} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00300043003000420030003500410046002d0046003100450043002d0034003000310039002d0038004400340032002d004300350034004400350044004400340031004500420041007d000000 + {.0.C.0.B.0.5.A.F.-.F.1.E.C.-.4.0.1.9.-.8.D.4.2.-.C.5.4.D.5.D.D.4.1.E.B.A.}... + + 9223372036854776467 + + + {6b9eebdb-a4d1-451c-9830-de157ab09a0a} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00430045004300380041003000420044002d0042004500320041002d0034003900440034002d0038004200310044002d004400440032003900340035004300440039003300440046007d000000 + {.C.E.C.8.A.0.B.D.-.B.E.2.A.-.4.9.D.4.-.8.B.1.D.-.D.D.2.9.4.5.C.D.9.3.D.F.}... + + 9223372036854776468 + + + {3e440dea-e76d-48aa-b372-560e409b30f1} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 + I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... + + 9223372036854776481 + + + {9d6ea685-ea31-45e1-b8da-a022482c5663} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 + I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... + + 9223372036854776482 + + + {e6cbde25-ce3a-4f6c-ad20-2430fc3be2ec} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 + I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... + + 9223372036854776483 + + + {d67aa0d4-e024-4a5e-b849-9b0a4411f2c7} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 + I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... + + 9223372036854776484 + + + {e7d69b11-d4ea-4140-afc1-3bd5e7bc77d3} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 + I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... + + 9223372036854776485 + + + {d4108881-9c33-48bd-9ba2-da4340a6d656} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000 + I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s... + + 9223372036854776486 + + + {321945bf-7e0d-4d0b-ba60-4c35526d1059} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00370034003000390038003700450033002d0038004200460039002d0034003000330033002d0038004400330032002d004200440030003200340036003900430035003500360032007d000000 + {.7.4.0.9.8.7.E.3.-.8.B.F.9.-.4.0.3.3.-.8.D.3.2.-.B.D.0.2.4.6.9.C.5.5.6.2.}... + + 9223372036854776489 + + + {fd7430b7-c11f-4981-beb4-57061db06e47} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310033004400310037003200340045002d0043003100300041002d0034004200360044002d0042003000300039002d003900370033004600320032003600440043004400340046007d000000 + {.1.3.D.1.7.2.4.E.-.C.1.0.A.-.4.B.6.D.-.B.0.0.9.-.9.7.3.F.2.2.6.D.C.D.4.F.}... + + 9223372036854776490 + + + {3576462a-269e-4a46-9f90-72d5b7c9c10e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006800690065006c006400650064002000490043004d00500020007600340020004f00750074000000 + S.h.i.e.l.d.e.d. .I.C.M.P. .v.4. .O.u.t... + + 9223372036854776491 + + + {5848fa86-7a5a-4193-9e0b-e6a3e69395f8} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006800690065006c006400650064002000490043004d00500020007600360020004f00750074000000 + S.h.i.e.l.d.e.d. .I.C.M.P. .v.6. .O.u.t... + + 9223372036854776492 + + + {8ab03769-319b-4d2e-81dd-8edc91cbbb8c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006800690065006c006400650064002000490043004d00500020007600340020004f00750074000000 + S.h.i.e.l.d.e.d. .I.C.M.P. .v.4. .O.u.t... + + 9223372036854776493 + + + {302e8ae9-db45-4f11-bf3d-20e0807f3804} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006800690065006c006400650064002000490043004d00500020007600360020004f00750074000000 + S.h.i.e.l.d.e.d. .I.C.M.P. .v.6. .O.u.t... + + 9223372036854776494 + + + {aa4a4221-6f16-4b9c-9a07-b4b4ba6a6bf2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006800690065006c006400650064002000490043004d00500020007600340020004f00750074000000 + S.h.i.e.l.d.e.d. .I.C.M.P. .v.4. .O.u.t... + + 9223372036854776495 + + + {11a26e34-bc51-40d3-b421-822ad6efbb3e} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 53006800690065006c006400650064002000490043004d00500020007600360020004f00750074000000 + S.h.i.e.l.d.e.d. .I.C.M.P. .v.6. .O.u.t... + + 9223372036854776496 + + + {7b4bd8fd-5d1f-4b8c-9836-4a01a350e746} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00320033004300340039003900450031002d0043003700360042002d0034003700300035002d0041003700310031002d004400450041004400360032004300380033003800440033007d000000 + {.2.3.C.4.9.9.E.1.-.C.7.6.B.-.4.7.0.5.-.A.7.1.1.-.D.E.A.D.6.2.C.8.3.8.D.3.}... + + 9223372036854776497 + + + {ab88322b-f465-4441-9345-715826fcab31} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00420045003800300036004300350034002d0041003800410046002d0034003200330043002d0039004500350036002d004300350041003800300033004600450041003300310033007d000000 + {.B.E.8.0.6.C.5.4.-.A.8.A.F.-.4.2.3.C.-.9.E.5.6.-.C.5.A.8.0.3.F.E.A.3.1.3.}... + + 9223372036854776498 + + + {d6011340-9eba-4253-9ed0-a763c7ef7b6c} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00310042004100420031003400360035002d0034003000430045002d0034003500390039002d0039004500420032002d003200340035003600440030004600420041003300330043007d000000 + {.1.B.A.B.1.4.6.5.-.4.0.C.E.-.4.5.9.9.-.9.E.B.2.-.2.4.5.6.D.0.F.B.A.3.3.C.}... + + 9223372036854776499 + + + {6186f5b6-f4b7-414d-ba20-a82103204847} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00440031003000440041003000340039002d0041004500340035002d0034003200370032002d0039003900450032002d004600370046003800350035003200450046003700420030007d000000 + {.D.1.0.D.A.0.4.9.-.A.E.4.5.-.4.2.7.2.-.9.9.E.2.-.F.7.F.8.5.5.2.E.F.7.B.0.}... + + 9223372036854776500 + + + {c4f20cf5-f405-49a7-b6a4-97b66f9cf587} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00420041004500420032003100440043002d0039003100330043002d0034004100300037002d0039004400440042002d004400320034003400360041003400390041003200360036007d000000 + {.B.A.E.B.2.1.D.C.-.9.1.3.C.-.4.A.0.7.-.9.D.D.B.-.D.2.4.4.6.A.4.9.A.2.6.6.}... + + 9223372036854776501 + + + {ba22195c-728b-4815-be61-4a4f69743fe2} + + MPSSVC + Stores filter origin + + + FWPM_PROVIDER_MPSSVC_WF + + FWPM_GENERAL_CONTEXT + + 7b00330030003600350032004100450030002d0035003300320031002d0034003200390033002d0041004100430042002d003200440045003300300042004500360033003600340034007d000000 + {.3.0.6.5.2.A.E.0.-.5.3.2.1.-.4.2.9.3.-.A.A.C.B.-.2.D.E.3.0.B.E.6.3.6.4.4.}... + + 9223372036854776502 + + + + + FWPM_SUBLAYER_INSPECTION + + WFP Built-in Inspection Sublayer + + + + + + 0 + + + FWPM_SUBLAYER_TEREDO + + WFP Built-in Edge Traversal Sublayer + + + + + + 1 + + + FWPM_SUBLAYER_MPSSVC_WF + + WFP Built-in MPSSVC Windows Firewall Sublayer + + + + FWPM_PROVIDER_MPSSVC_WF + + 2 + + + FWPM_SUBLAYER_MPSSVC_WSH + + WFP Built-in MPSSVC Windows Service Hardening Sublayer + + + + FWPM_PROVIDER_MPSSVC_WSH + + 3 + + + FWPM_SUBLAYER_MPSSVC_QUARANTINE + + WFP Built-in MPSSVC Quarantine Sublayer + + + + FWPM_PROVIDER_MPSSVC_WSH + + 4 + + + FWPM_SUBLAYER_MPSSVC_EDP + + WFP Built-in MPSSVC Enterprise Data Protection Sublayer + + + + FWPM_PROVIDER_MPSSVC_EDP + + 5 + + + FWPM_SUBLAYER_MPSSVC_TENANT_RESTRICTIONS + + WFP Built-in MPSSVC Tenant Restrictions Sublayer + + + + FWPM_PROVIDER_MPSSVC_TENANT_RESTRICTIONS + + 6 + + + FWPM_SUBLAYER_MPSSVC_APP_ISOLATION + + WFP Built-in MPSSVC App Isolation Sublayer + + + + FWPM_PROVIDER_MPSSVC_APP_ISOLATION + + 7 + + + {7b6b11f6-cbb5-433c-ae06-6a4f0076e49e} + + Edge traversal Teredo Authorization Sublayer + Edge traversal Teredo Authorization Sublayer + + + + + 8 + + + {3c1cd879-1b8c-4ab4-8f83-5ed129176ef3} + + windefend + + + + + + 4096 + + + FWPM_SUBLAYER_TCP_CHIMNEY_OFFLOAD + + WFP Built-in TCP Chimney Offload Sublayer + + + + + + 8192 + + + FWPM_SUBLAYER_TCP_TEMPLATES + + WFP Built-in TCP Templates Sublayer + + + + + + 8704 + + + FWPM_SUBLAYER_IPSEC_SECURITY_REALM + + WFP Built-in IPsec Security Realm Sublayer + + + + + + 12288 + + + FWPM_SUBLAYER_SECURE_SOCKET + + WFP Built-in Secure Socket Sublayer + + + + + + 16384 + + + FWPM_SUBLAYER_LIPS + + WFP Built-in Legacy IPsec Sublayer + + + + + + 32767 + + + FWPM_SUBLAYER_UNIVERSAL + + WFP Built-in Universal Sublayer + + + + + + 32768 + + + FWPM_SUBLAYER_IPSEC_DOSP + + WFP Built-in IPsec DoS Protection Sublayer + + + + + + 34816 + + + FWPM_SUBLAYER_IPSEC_FORWARD_OUTBOUND_TUNNEL + + WFP Built-in IPsec Forward Outbound Tunnel Sublayer + + + + + + 36864 + + + FWPM_SUBLAYER_IPSEC_TUNNEL + + WFP Built-in IPsec Tunnel Sublayer + + + + + + 40960 + + + {9ba30013-c84e-47e5-ac6e-1e1aed72fa69} + + Microsoft Corporation + + + + FWPM_SUBLAYER_FLAG_PERSISTENT + + {1bebc969-61a5-4732-a177-847a0817862a} + + 40961 + + + FWPM_SUBLAYER_RPC_AUDIT + + RPC Built-in Audit Sublayer + + + + + + 49152 + + + {a87fb472-fc68-4805-8559-c6ae774773e0} + + PortmasterSublayer + The Portmaster sublayer holds all it's filters. + + + + + 65535 + + +`) diff --git a/core/api.go b/core/api.go index 11c15486..97adb4cd 100644 --- a/core/api.go +++ b/core/api.go @@ -4,12 +4,15 @@ import ( "net/http" "github.com/safing/portbase/api" + "github.com/safing/portbase/config" "github.com/safing/portbase/log" "github.com/safing/portbase/modules" "github.com/safing/portbase/utils/debug" + "github.com/safing/portmaster/compat" "github.com/safing/portmaster/resolver" "github.com/safing/portmaster/status" "github.com/safing/portmaster/updates" + "github.com/safing/spn/captain" ) func registerAPIEndpoints() error { @@ -85,7 +88,10 @@ func debugInfo(ar *api.Request) (data []byte, err error) { di.AddVersionInfo() di.AddPlatformInfo(ar.Context()) status.AddToDebugInfo(di) + config.AddToDebugInfo(di) resolver.AddToDebugInfo(di) + captain.AddToDebugInfo(di) + compat.AddToDebugInfo(di) di.AddLastReportedModuleError() di.AddLastUnexpectedLogs() di.AddGoroutineStack() diff --git a/netenv/environment_windows.go b/netenv/environment_windows.go index 24bccd9b..21cd6f2b 100644 --- a/netenv/environment_windows.go +++ b/netenv/environment_windows.go @@ -110,7 +110,7 @@ func getDefaultInterface() *defaultNetInterface { newIf := &defaultNetInterface{} // Scan data for needed fields. - scanner := bufio.NewScanner(bytes.NewBufferString(interfaceData)) + scanner := bufio.NewScanner(bytes.NewBuffer(interfaceData)) scanner.Split(bufio.ScanLines) var segmentKey, segmentValue, previousKey string for scanner.Scan() { From ef64acd27140997be7f9a588c84c460069550570 Mon Sep 17 00:00:00 2001 From: Daniel Date: Sat, 19 Mar 2022 21:55:09 +0100 Subject: [PATCH 2/4] Mark config options as sensitive --- profile/config.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/profile/config.go b/profile/config.go index e9d9f5ef..b89f3777 100644 --- a/profile/config.go +++ b/profile/config.go @@ -264,6 +264,7 @@ Important: DNS Requests are only matched against domain and filter list rules, a Key: CfgOptionEndpointsKey, Description: "Rules that apply to outgoing network connections. Cannot overrule Network Scopes and Connection Types (see above).", Help: rulesHelp, + Sensitive: true, OptType: config.OptTypeStringArray, DefaultValue: []string{}, Annotations: config.Annotations{ @@ -287,6 +288,7 @@ Important: DNS Requests are only matched against domain and filter list rules, a Key: CfgOptionServiceEndpointsKey, Description: "Rules that apply to incoming network connections. Cannot overrule Network Scopes and Connection Types (see above). Also note that the default action for incoming connections is to always block.", Help: rulesHelp, + Sensitive: true, OptType: config.OptTypeStringArray, DefaultValue: []string{"+ Localhost"}, ExpertiseLevel: config.ExpertiseLevelExpert, @@ -620,6 +622,7 @@ Please note that if you are using the system resolver, bypass attempts might be Key: CfgOptionSPNUsagePolicyKey, Description: `Customize which websites should or should not be routed through the SPN. Only active if "Use SPN" is enabled.`, Help: rulesHelp, + Sensitive: true, OptType: config.OptTypeStringArray, DefaultValue: []string{}, Annotations: config.Annotations{ @@ -646,6 +649,7 @@ Please note that if you are using the system resolver, bypass attempts might be By default, the Portmaster tries to choose the node closest to the destination as the Exit Node. This reduces your exposure to the open Internet. Exit Nodes are chosen for every destination separately.`, Help: SPNRulesHelp, + Sensitive: true, OptType: config.OptTypeStringArray, DefaultValue: []string{}, Annotations: config.Annotations{ From 90a113397f8822443b86db54a61f7a5143648d03 Mon Sep 17 00:00:00 2001 From: Daniel Date: Tue, 22 Mar 2022 13:55:46 +0100 Subject: [PATCH 3/4] Implement review suggestions --- nameserver/response.go | 2 ++ resolver/resolvers.go | 3 +++ updates/upgrader.go | 1 + 3 files changed, 6 insertions(+) diff --git a/nameserver/response.go b/nameserver/response.go index d78888c8..92dd80af 100644 --- a/nameserver/response.go +++ b/nameserver/response.go @@ -28,6 +28,8 @@ func sendResponse( return nil } // Signify that we are a recursive resolver. + // While we do not handle recursion directly, we can safely assume, that we + // always forward to a recursive resolver. reply.RecursionAvailable = true // Add extra RRs through a custom RRProvider. diff --git a/resolver/resolvers.go b/resolver/resolvers.go index 2e66b332..0f7eaa16 100644 --- a/resolver/resolvers.go +++ b/resolver/resolvers.go @@ -205,12 +205,15 @@ func createResolver(resolverURL, source string) (*Resolver, bool, error) { } func configureSearchDomains(resolver *Resolver, searches []string, hardfail bool) error { + resolver.Search = make([]string, 0, len(searches)) + // Check all search domains. for i, value := range searches { trimmedDomain := strings.ToLower(strings.Trim(value, ".")) err := checkSearchScope(trimmedDomain) if err != nil { if hardfail { + resolver.Search = nil return fmt.Errorf("failed to validate search domain #%d: %w", i+1, err) } log.Warningf("resolver: skipping invalid search domain for resolver %s: %s", resolver, utils.SafeFirst16Chars(value)) diff --git a/updates/upgrader.go b/updates/upgrader.go index a97f89a9..aabc2441 100644 --- a/updates/upgrader.go +++ b/updates/upgrader.go @@ -117,6 +117,7 @@ func upgradeCoreNotify() error { ), ShowOnSystem: true, AvailableActions: []*notifications.Action{ + // TODO: Use special UI action in order to reload UI on restart. { ID: "restart", Text: "Restart", From f1a028637289868f60b704e2de0d55f968acb426 Mon Sep 17 00:00:00 2001 From: Daniel Date: Tue, 22 Mar 2022 13:56:05 +0100 Subject: [PATCH 4/4] Update deps --- go.mod | 14 ++++++++------ go.sum | 30 ++++++++++++++++++++++-------- 2 files changed, 30 insertions(+), 14 deletions(-) diff --git a/go.mod b/go.mod index f6ecb616..bb5e246a 100644 --- a/go.mod +++ b/go.mod @@ -11,18 +11,20 @@ require ( github.com/google/gopacket v1.1.19 github.com/hashicorp/go-multierror v1.1.1 github.com/hashicorp/go-version v1.4.0 - github.com/mdlayher/socket v0.2.2 // indirect - github.com/miekg/dns v1.1.46 + github.com/mdlayher/socket v0.2.3 // indirect + github.com/miekg/dns v1.1.47 github.com/oschwald/maxminddb-golang v1.8.0 - github.com/safing/portbase v0.14.0 - github.com/safing/spn v0.4.3 + github.com/safing/portbase v0.14.1 + github.com/safing/spn v0.4.4 github.com/shirou/gopsutil v3.21.11+incompatible - github.com/spf13/cobra v1.3.0 + github.com/spf13/cobra v1.4.0 github.com/stretchr/testify v1.7.0 github.com/tannerryan/ring v1.1.2 github.com/tevino/abool v1.2.0 github.com/umahmood/haversine v0.0.0-20151105152445-808ab04add26 + golang.org/x/crypto v0.0.0-20220321153916-2c7772ba3064 // indirect golang.org/x/net v0.0.0-20220225172249-27dd8689420f golang.org/x/sync v0.0.0-20210220032951-036812b2e83c - golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9 + golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8 + golang.org/x/tools v0.1.10 // indirect ) diff --git a/go.sum b/go.sum index 247f730e..ba97c4c0 100644 --- a/go.sum +++ b/go.sum @@ -663,6 +663,8 @@ github.com/mdlayher/netlink v1.4.0/go.mod h1:dRJi5IABcZpBD2A3D0Mv/AiX8I9uDEu5oGk github.com/mdlayher/netlink v1.4.1/go.mod h1:e4/KuJ+s8UhfUpO9z00/fDZZmhSrs+oxyqAS9cNgn6Q= github.com/mdlayher/netlink v1.5.0/go.mod h1:1Kr8BBFxGyUyNmztC9WLOayqYVAd2wsgOZm18nqGuzQ= github.com/mdlayher/netlink v1.6.0 h1:rOHX5yl7qnlpiVkFWoqccueppMtXzeziFjWAjLg6sz0= +github.com/mdlayher/netlink v1.6.0 h1:rOHX5yl7qnlpiVkFWoqccueppMtXzeziFjWAjLg6sz0= +github.com/mdlayher/netlink v1.6.0/go.mod h1:0o3PlBmGst1xve7wQ7j/hwpNaFaH4qCRyWCdcZk8/vA= github.com/mdlayher/netlink v1.6.0/go.mod h1:0o3PlBmGst1xve7wQ7j/hwpNaFaH4qCRyWCdcZk8/vA= github.com/mdlayher/socket v0.0.0-20210307095302-262dc9984e00/go.mod h1:GAFlyu4/XV68LkQKYzKhIo/WW7j3Zi0YRAz/BOoanUc= github.com/mdlayher/socket v0.0.0-20210624160740-9dbe287ded84/go.mod h1:GAFlyu4/XV68LkQKYzKhIo/WW7j3Zi0YRAz/BOoanUc= @@ -671,8 +673,9 @@ github.com/mdlayher/socket v0.0.0-20211102153432-57e3fa563ecb/go.mod h1:nFZ1EtZY github.com/mdlayher/socket v0.1.0/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs= github.com/mdlayher/socket v0.1.1/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs= github.com/mdlayher/socket v0.2.0/go.mod h1:QLlNPkFR88mRUNQIzRBMfXxwKal8H7u1h3bL1CV+f0E= -github.com/mdlayher/socket v0.2.2 h1:UOh5gQk70kRl1YMLCTRwRF4MvsAQsudjkEA+ZDXS4jo= github.com/mdlayher/socket v0.2.2/go.mod h1:IcNFWYJJuSGgnfKie27UfpEDWytPDqy+TrDd9I5hUKQ= +github.com/mdlayher/socket v0.2.3 h1:XZA2X2TjdOwNoNPVPclRCURoX/hokBY8nkTmRZFEheM= +github.com/mdlayher/socket v0.2.3/go.mod h1:bz12/FozYNH/VbvC3q7TRIK/Y6dH1kCKsXaUeXi/FmY= github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= @@ -682,8 +685,9 @@ github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJys github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4= github.com/miekg/dns v1.1.44/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME= github.com/miekg/dns v1.1.45/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME= -github.com/miekg/dns v1.1.46 h1:uzwpxRtSVxtcIZmz/4Uz6/Rn7G11DvsaslXoy5LxQio= github.com/miekg/dns v1.1.46/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME= +github.com/miekg/dns v1.1.47 h1:J9bWiXbqMbnZPcY8Qi2E3EWIBsIm6MZzzJB9VRg5gL8= +github.com/miekg/dns v1.1.47/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME= github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc= github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI= github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw= @@ -807,8 +811,9 @@ github.com/safing/portbase v0.13.3/go.mod h1:5vj5IK5WJoSGareDe6yCMZfnF7txVRx7jZy github.com/safing/portbase v0.13.4/go.mod h1:5vj5IK5WJoSGareDe6yCMZfnF7txVRx7jZyTZInISP0= github.com/safing/portbase v0.13.5/go.mod h1:5vj5IK5WJoSGareDe6yCMZfnF7txVRx7jZyTZInISP0= github.com/safing/portbase v0.13.6/go.mod h1:G0maDSQxYDuluNhMzA1zVd/nfXawfECv5H7+fnTfVhM= -github.com/safing/portbase v0.14.0 h1:6+sdUs1tdRCKnyuzy/zHrvUsdO1GdI0l4gZaoYJmJ5Q= github.com/safing/portbase v0.14.0/go.mod h1:z9sRR/vqohAGdYSSx2B+o8tND4WVvcxPL6XBBtN3bDI= +github.com/safing/portbase v0.14.1 h1:k/SgywE5QutDbf5hHbEArrQnjBByerGm0nhh5n8VnDw= +github.com/safing/portbase v0.14.1/go.mod h1:z9sRR/vqohAGdYSSx2B+o8tND4WVvcxPL6XBBtN3bDI= github.com/safing/portmaster v0.7.3/go.mod h1:o//kZ8eE+5vT1V22mgnxHIAdlEz42sArsK5OF2Lf/+s= github.com/safing/portmaster v0.7.4/go.mod h1:Q93BWdF1oAL0oUMukshl8W1aPZhmrlTGi6tFTFc3pTw= github.com/safing/portmaster v0.7.6/go.mod h1:qOs9hQtvAzTVICRbwLg3vddqOaqJHeWBjWQ0C+TJ/Bw= @@ -822,6 +827,7 @@ github.com/safing/portmaster v0.7.18/go.mod h1:NXd1l1z0oKy0WfXMhv/gpAXz+pUHnlNuY github.com/safing/portmaster v0.7.21/go.mod h1:Jy0G6x6m5dE36Mv9grXHI77cxysQ0fIQV1EYQ00WEiQ= github.com/safing/portmaster v0.8.0/go.mod h1:lY2/WvOlH8kl1AwkixdWCjlo+PZQv+oEOQhIaSS/+wA= github.com/safing/portmaster v0.8.5-interdep/go.mod h1:A+zAVEKjr057ktgiMSJRdUmOF+FPW8XY/5LqGnbsKbU= +github.com/safing/portmaster v0.8.5/go.mod h1:MqOlFwHcIx/109Ugutz/CG23znuuXCRVHcIcfX0VC/c= github.com/safing/spn v0.3.4/go.mod h1:TfzNsZCbnlWv0UFDILFOUSudVKJZlnBVoR1fDXrjOK0= github.com/safing/spn v0.3.5/go.mod h1:jHkFF2Yu1fnjFu4KXjVA+iagMr/z4eB4p3jiwikvKj8= github.com/safing/spn v0.3.6/go.mod h1:RSeFb/h5Wt3yDVezXj3lhXJ/Iwd7FbtsGf5E+p5J2YQ= @@ -837,6 +843,8 @@ github.com/safing/spn v0.4.0/go.mod h1:0jBetnYCfxqO5PJskhPOxJ/v6VRfE+bQU98XW240B github.com/safing/spn v0.4.2/go.mod h1:yZPezHDEYyhei8n13tTxjQCGq6LRr5svz9WFAAeDPec= github.com/safing/spn v0.4.3 h1:iEFmpzyrThJ8QF9Qpbxk/m4w2+ZvbVPyuqJ4EwnpfDg= github.com/safing/spn v0.4.3/go.mod h1:YHtg3FkZviN8T7db4BdRffbYO1pO7w9SydQatLmvW2M= +github.com/safing/spn v0.4.4 h1:DGCkHaCgkQ0ivsD3J3BkUJ2auMpCEhzZdlD3JDmK/U4= +github.com/safing/spn v0.4.4/go.mod h1:mkQA5pYM1SUd4JkTyuwXFycFMGQXLTd9RUJuY2vqccM= github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig= github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww= github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0= @@ -879,8 +887,9 @@ github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKv github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU= github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo= github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk= -github.com/spf13/cobra v1.3.0 h1:R7cSvGu+Vv+qX0gW5R/85dx2kmmJT5z5NM8ifdYjdn0= github.com/spf13/cobra v1.3.0/go.mod h1:BrRVncBjOJa/eUcVVm9CE+oC6as8k+VYr4NY7WCi9V4= +github.com/spf13/cobra v1.4.0 h1:y+wJpx64xcgO1V+RcnwW0LEHxTKRi2ZDPSBjWnrg88Q= +github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g= github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo= github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo= github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= @@ -1059,8 +1068,10 @@ golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871/go.mod h1:IxCIyHEi3zRg3s0 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.0.0-20220213190939-1e6e3497d506/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.0.0-20220214200702-86341886e292 h1:f+lwQ+GtmgoY+A2YaQxlSOnDjXcQ7ZRLWOHbC6HtRqE= golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= +golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= +golang.org/x/crypto v0.0.0-20220321153916-2c7772ba3064 h1:S25/rfnfsMVgORT4/J61MJ7rdyseOZOyvLIrZEZ7s6s= +golang.org/x/crypto v0.0.0-20220321153916-2c7772ba3064/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -1097,8 +1108,9 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro= -golang.org/x/mod v0.5.1 h1:OJxoQ/rynoF0dcCdI7cLPktw/hR2cueqYfjm43oqK38= golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro= +golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 h1:kQgndtyPBW/JIYERgdxfwMYh3AVStj88WQTlNDi2a+o= +golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -1329,8 +1341,9 @@ golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220224120231-95c6836cb0e7/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9 h1:nhht2DYV/Sn3qOayu8lM+cU1ii9sTLUeBQwQQfUHtrs= golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8 h1:OH54vjqzRWmbJ62fjuhxy7AxFFgoHN0/DPc/UrL8cAs= +golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= @@ -1425,8 +1438,9 @@ golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyj golang.org/x/tools v0.1.6/go.mod h1:LGqMHiF4EqQNHR1JncWGqT5BVaXmza+X+BDGol+dOxo= golang.org/x/tools v0.1.7/go.mod h1:LGqMHiF4EqQNHR1JncWGqT5BVaXmza+X+BDGol+dOxo= golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU= -golang.org/x/tools v0.1.9 h1:j9KsMiaP1c3B0OTQGth0/k+miLGTgLsAFUCrF2vLcF8= golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU= +golang.org/x/tools v0.1.10 h1:QjFRCZxdOhBJ/UNgnBZLbNV13DlbnK0quyivTnXJM20= +golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=