mirror of
https://github.com/safing/portmaster
synced 2025-09-01 18:19:12 +00:00
56270 lines
1.9 MiB
56270 lines
1.9 MiB
package compat
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestWFPState(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
w, err := parseWFPState(wfpTestData)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
output := w.simplified().AsTable()
|
|
fmt.Println(output)
|
|
|
|
outputLines := strings.Count(output, "\n")
|
|
if outputLines != 10 {
|
|
t.Errorf("Expected 10 output lines, not %d", outputLines)
|
|
}
|
|
}
|
|
|
|
var wfpTestData = []byte(`<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
|
<wfpstate>
|
|
<layers numItems="97">
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V4</layerKey>
|
|
<displayData>
|
|
<name>Inbound IP Packet v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>0</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{05c55149-4732-4857-8d10-f178f3a06f8c}</calloutKey>
|
|
<displayData>
|
|
<name>PortmasterInboundV4Callout</name>
|
|
<description>This callout is used by the Portmaster to intercept inbound IPv4 traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_IPPACKET_V4</applicableLayer>
|
|
<calloutId>290</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{fb2f56c5-3883-475a-8c78-047d1f93b5a9}</filterKey>
|
|
<displayData>
|
|
<name>PortmasterInboundV4Filter</name>
|
|
<description>This filter is used by the Portmaster to intercept inbound IPv4 traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V4</layerKey>
|
|
<subLayerKey>{a87fb472-fc68-4805-8559-c6ae774773e0}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>15</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>{05c55149-4732-4857-8d10-f178f3a06f8c}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68136</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>17293822569102704640</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Inbound IP Packet v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>1</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V6</layerKey>
|
|
<displayData>
|
|
<name>Inbound IP Packet v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>2</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{ceff1df7-2baa-44c5-a6e5-73a95849bcff}</calloutKey>
|
|
<displayData>
|
|
<name>PortmasterInboundV6Callout</name>
|
|
<description>This callout is used by the Portmaster to intercept inbound IPv6 traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_IPPACKET_V6</applicableLayer>
|
|
<calloutId>292</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{778afeeb-9680-4a59-82d5-abc33b3fb183}</filterKey>
|
|
<displayData>
|
|
<name>PortmasterInboundV6Filter</name>
|
|
<description>This filter is used by the Portmaster to intercept inbound IPv6 traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V6</layerKey>
|
|
<subLayerKey>{a87fb472-fc68-4805-8559-c6ae774773e0}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>15</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>{ceff1df7-2baa-44c5-a6e5-73a95849bcff}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68138</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>17293822569102704640</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Inbound IP Packet v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>3</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V4</layerKey>
|
|
<displayData>
|
|
<name>Outbound IP Packet v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>4</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{41162b9e-8473-4b88-a5eb-04cf1d276b06}</calloutKey>
|
|
<displayData>
|
|
<name>PortmasterOutboundV4Callout</name>
|
|
<description>This callout is used by the Portmaster to intercept outbound IPv4 traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_IPPACKET_V4</applicableLayer>
|
|
<calloutId>291</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{609b24b3-7b9a-48e1-8994-c72a42bbd319}</filterKey>
|
|
<displayData>
|
|
<name>PortmasterOutboundV4Filter</name>
|
|
<description>This filter is used by the Portmaster to intercept outbound IPv4 traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V4</layerKey>
|
|
<subLayerKey>{a87fb472-fc68-4805-8559-c6ae774773e0}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>15</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>{41162b9e-8473-4b88-a5eb-04cf1d276b06}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68137</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>17293822569102704640</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Outbound IP Packet v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>5</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V6</layerKey>
|
|
<displayData>
|
|
<name>Outbound IP Packet v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>6</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{32bad112-6af4-4109-809b-c07570ba01b4}</calloutKey>
|
|
<displayData>
|
|
<name>PortmasterOutboundV6Callout</name>
|
|
<description>This callout is used by the Portmaster to intercept outbound IPv6 traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_IPPACKET_V6</applicableLayer>
|
|
<calloutId>293</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{23ae199a-7949-4059-b799-67e7a1a57fcb}</filterKey>
|
|
<displayData>
|
|
<name>PortmasterOutboundV6Filter</name>
|
|
<description>This filter is used by the Portmaster to intercept outbound IPv6 traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V6</layerKey>
|
|
<subLayerKey>{a87fb472-fc68-4805-8559-c6ae774773e0}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>15</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>{32bad112-6af4-4109-809b-c07570ba01b4}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68139</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>17293822569102704640</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Outbound IP Packet v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>7</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IPFORWARD_V4</layerKey>
|
|
<displayData>
|
|
<name>IP Forward v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="15">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>8</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Forward Inbound Tunnel v4 Layer Callout</name>
|
|
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000020</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_IPFORWARD_V4</applicableLayer>
|
|
<calloutId>9</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Forward Outbound Tunnel v4 Layer Callout</name>
|
|
<description>Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000020</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_IPFORWARD_V4</applicableLayer>
|
|
<calloutId>11</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{935b7f48-0ede-44dd-9bc2-e00bb635cda3}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_IPFORWARD_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>786432</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66238</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>4</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IPFORWARD_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>IP Forward v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="15">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>9</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IPFORWARD_V6</layerKey>
|
|
<displayData>
|
|
<name>IP Forward v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="15">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>10</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Forward Inbound Tunnel v6 Layer Callout</name>
|
|
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000020</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_IPFORWARD_V6</applicableLayer>
|
|
<calloutId>10</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Forward Outbound Tunnel v6 Layer Callout</name>
|
|
<description>Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000020</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_IPFORWARD_V6</applicableLayer>
|
|
<calloutId>12</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{941dad9d-7b1a-4354-997b-00cf1aa9b35c}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_IPFORWARD_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>786432</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66239</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>4</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IPFORWARD_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>IP Forward v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="15">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>11</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4</layerKey>
|
|
<displayData>
|
|
<name>Inbound Transport v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="15">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>12</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Inbound Transport v4 Layer Callout</name>
|
|
<description>Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000260</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4</applicableLayer>
|
|
<calloutId>1</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Inbound Tunnel v4 Layer Callout</name>
|
|
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000020</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4</applicableLayer>
|
|
<calloutId>5</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Inbound Transport v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="15">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>13</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Silent Drop Transport v4 Discard Layer Callout</name>
|
|
<description>Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000240</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</applicableLayer>
|
|
<calloutId>17</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="4">
|
|
<item>
|
|
<filterKey>{03c67493-1802-44a0-ad5f-3ae741e25c15}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68060</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{29ccd323-aecf-4990-b96a-c5384222b0c9}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68062</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{92ff43ac-9df0-49e9-b3b3-d6f8421edcca}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP</filterType>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68064</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b2a53430-2096-4b30-ae54-260f96a82028}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>12</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP</filterType>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68066</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>13835058055349272576</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6</layerKey>
|
|
<displayData>
|
|
<name>Inbound Transport v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="15">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>14</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Inbound Transport v6 Layer Callout</name>
|
|
<description>Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000260</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6</applicableLayer>
|
|
<calloutId>2</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Inbound Tunnel v6 Layer Callout</name>
|
|
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000020</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6</applicableLayer>
|
|
<calloutId>6</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Inbound Transport v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="15">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>15</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Silent Drop Transport v6 Discard Layer Callout</name>
|
|
<description>Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000240</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</applicableLayer>
|
|
<calloutId>18</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="4">
|
|
<item>
|
|
<filterKey>{57175e0d-0212-4ddd-b229-559795b43af7}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68061</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d979d760-083e-489d-9360-1f377b606ef1}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68063</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{22b3ef06-6428-47ac-868f-b4a968fe995c}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP</filterType>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68065</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f3ecd3f5-9498-4dce-a76d-da32be01382f}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>12</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP</filterType>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68067</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>13835058055298940928</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</layerKey>
|
|
<displayData>
|
|
<name>Outbound Transport v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="16">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>16</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Outbound Transport v4 Layer Callout</name>
|
|
<description>Indicates to IPsec the outbound traffic that must be secured over transport mode security associations.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000260</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</applicableLayer>
|
|
<calloutId>3</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Outbound Tunnel v4 Layer Callout</name>
|
|
<description>Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000020</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</applicableLayer>
|
|
<calloutId>7</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Outbound Transport v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="16">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>17</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</layerKey>
|
|
<displayData>
|
|
<name>Outbound Transport v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="16">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>18</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Outbound Transport v6 Layer Callout</name>
|
|
<description>Indicates to IPsec the outbound traffic that must be secured over transport mode security associations.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000260</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</applicableLayer>
|
|
<calloutId>4</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Outbound Tunnel v6 Layer Callout</name>
|
|
<description>Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000020</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</applicableLayer>
|
|
<calloutId>8</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Outbound Transport v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="16">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>19</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_STREAM_V4</layerKey>
|
|
<displayData>
|
|
<name>Stream v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
<item>FWPM_LAYER_FLAG_BUFFERED</item>
|
|
</flags>
|
|
<field numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>20</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0414}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Connection-oriented protocol packet inspection.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_STREAM_V4</applicableLayer>
|
|
<calloutId>288</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{d67b238d-d80c-4ba7-96df-4a0c83464fa7}</calloutKey>
|
|
<displayData>
|
|
<name>windefend_stream_v4</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_STREAM_V4</applicableLayer>
|
|
<calloutId>294</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="2">
|
|
<item>
|
|
<filterKey>{821997be-23bb-4240-87a2-2615caec3d1f}</filterKey>
|
|
<displayData>
|
|
<name>Deep Protocol Inspection Filter</name>
|
|
<description>This filter implements deep inspection for FTP protocols.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_STREAM_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0414}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68050</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{42e67750-e0ae-4ec7-aa42-97c6605b1c96}</filterKey>
|
|
<displayData>
|
|
<name>windefend_stream_v4</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_STREAM_V4</layerKey>
|
|
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>{d67b238d-d80c-4ba7-96df-4a0c83464fa7}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68276</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_STREAM_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Stream v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
<item>FWPM_LAYER_FLAG_BUFFERED</item>
|
|
</flags>
|
|
<field numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>21</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_STREAM_V6</layerKey>
|
|
<displayData>
|
|
<name>Stream v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
<item>FWPM_LAYER_FLAG_BUFFERED</item>
|
|
</flags>
|
|
<field numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>22</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0416}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Connection-oriented protocol packet inspection.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_STREAM_V6</applicableLayer>
|
|
<calloutId>289</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{36d4cf95-fd3a-4bb8-90a9-ffdb3749237f}</calloutKey>
|
|
<displayData>
|
|
<name>windefend_stream_v6</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_STREAM_V6</applicableLayer>
|
|
<calloutId>295</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="2">
|
|
<item>
|
|
<filterKey>{ecdc6e7a-8981-4a13-92d7-fb12f8d0ea9f}</filterKey>
|
|
<displayData>
|
|
<name>Deep Protocol Inspection Filter</name>
|
|
<description>This filter implements deep inspection for FTP protocols.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_STREAM_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0416}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68051</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{094b9bb6-e451-4069-ac23-5fe695ec9662}</filterKey>
|
|
<displayData>
|
|
<name>windefend_stream_v6</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_STREAM_V6</layerKey>
|
|
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>{36d4cf95-fd3a-4bb8-90a9-ffdb3749237f}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68277</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_STREAM_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Stream v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
<item>FWPM_LAYER_FLAG_BUFFERED</item>
|
|
</flags>
|
|
<field numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>23</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V4</layerKey>
|
|
<displayData>
|
|
<name>Datagram Data v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>24</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{b2d11c73-b4ef-47d1-b665-58e6ba9fe200}</calloutKey>
|
|
<displayData>
|
|
<name>windefend_datagram_v4</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_DATAGRAM_DATA_V4</applicableLayer>
|
|
<calloutId>300</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{67dc47f0-7a3b-4705-a4e7-bb8756a3e69f}</filterKey>
|
|
<displayData>
|
|
<name>windefend_datagram_v4</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V4</layerKey>
|
|
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>{b2d11c73-b4ef-47d1-b665-58e6ba9fe200}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68282</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Datagram Data v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>25</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V6</layerKey>
|
|
<displayData>
|
|
<name>Datagram Data v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>26</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{80cece9d-0b53-4672-ac43-4524416c0353}</calloutKey>
|
|
<displayData>
|
|
<name>windefend_datagram_v6</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_DATAGRAM_DATA_V6</applicableLayer>
|
|
<calloutId>301</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{f875d7d9-b132-436d-a729-479ef4e4ef08}</filterKey>
|
|
<displayData>
|
|
<name>windefend_datagram_v6</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V6</layerKey>
|
|
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>{80cece9d-0b53-4672-ac43-4524416c0353}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68283</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Datagram Data v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>27</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4</layerKey>
|
|
<displayData>
|
|
<name>Inbound ICMP Error v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="22">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>28</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters numItems="6">
|
|
<item>
|
|
<filterKey>{0c41d586-9c19-4e01-9d66-b5b98a97576e}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66212</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4d9581d2-aef8-4993-84cd-b986ced80d42}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66216</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{074f7f68-ee10-428a-89d1-ba78f6c327ca}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66224</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{91ffecf0-0a9e-4572-95f1-a7111af86967}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66228</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{08f09e8d-2754-4cc2-b595-7260f3a8df9d}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67629</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854775812</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b8b57642-80b0-49d5-b5d6-34834967743d}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67637</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540928</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Inbound ICMP Error v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="22">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>29</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e011d}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD</applicableLayer>
|
|
<calloutId>276</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
|
|
<displayData>
|
|
<name>Inbound ICMP Error v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="22">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>30</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters numItems="6">
|
|
<item>
|
|
<filterKey>{12c38916-82ac-4737-8f38-b6957ffebad6}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66213</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{be7cbdf4-b192-4aa5-94f8-1fb5c5ee07bc}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66217</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c016105c-eb34-4519-a5fd-5f4e4ad4d18e}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66225</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{64e55933-15a5-495d-a928-ccca43d44875}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66229</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{cc44ca04-e1d0-42ef-8fd1-ffe89f6ed166}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67633</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854775812</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{49ec4b6a-348d-41ae-8777-f7c59ec17f26}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67641</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540928</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Inbound ICMP Error v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="22">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_EMBEDDED_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>31</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e011f}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD</applicableLayer>
|
|
<calloutId>277</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<displayData>
|
|
<name>Outbound ICMP Error v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>32</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters numItems="15">
|
|
<item>
|
|
<filterKey>{07a24961-a760-4e80-b263-6d275e1b09cb}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66220</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b308b233-cd6c-401d-9f09-3a80217f778e}</filterKey>
|
|
<displayData>
|
|
<name>Default Outbound</name>
|
|
<description>This is the default outbound filter which blocks or permits traffic based on user configured default settings</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67643</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854775812</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{bfe4943b-6e61-4ae6-a187-d62d68351430}</filterKey>
|
|
<displayData>
|
|
<name>Default Outbound</name>
|
|
<description>This is the default outbound filter which blocks or permits traffic based on user configured default settings</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67647</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540928</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c313817b-32a7-4160-95b2-4673a26e0cab}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>0</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68068</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372586040164364</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3228da2c-00c2-4f05-8f8c-682315fe7530}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>12</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68069</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372585771728908</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a2fd53b1-e627-4962-aede-c508dac25267}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>14</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>255</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68070</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372584463106060</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2260bd8b-6481-4879-93f1-9435d24d2528}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>0</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68073</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372586040164364</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7224a028-a279-4c7b-b136-40f7516b88cc}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>12</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68074</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372585771728908</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3339fd71-a0e9-4714-87f6-e9ec698fab6b}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>14</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>255</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68075</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372584463106060</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9eaf6f7b-ed11-48fb-b3c5-592921db1103}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>0</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68078</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ef4ccd1e-f08d-4199-85e1-3ef56963f09e}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>12</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68079</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0365edae-cbe6-4657-8943-2d16058c98c2}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>14</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>255</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68080</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c2b8dc84-bfca-4c6d-ba88-5325839ea39f}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>0</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68083</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d5afb3be-9eb2-40c3-8fa9-3e8ee38948c5}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>12</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68084</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4c7ffc63-9f38-44b9-8624-b85abd89b7a6}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>14</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>255</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68085</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Outbound ICMP Error v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>33</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0121}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD</applicableLayer>
|
|
<calloutId>272</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<displayData>
|
|
<name>Outbound ICMP Error v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>34</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters numItems="11">
|
|
<item>
|
|
<filterKey>{5b0cb2e2-ab87-4974-9f1c-2f22a654eeb9}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66221</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{da00b2e8-656f-40cc-9a37-444f32c5e58a}</filterKey>
|
|
<displayData>
|
|
<name>Default Outbound</name>
|
|
<description>This is the default outbound filter which blocks or permits traffic based on user configured default settings</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67645</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854775812</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{70fb0d21-2477-44bc-967b-494c061e96eb}</filterKey>
|
|
<displayData>
|
|
<name>Default Outbound</name>
|
|
<description>This is the default outbound filter which blocks or permits traffic based on user configured default settings</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67649</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540928</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b9b272fb-b866-4e48-9385-c1bee91957da}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68071</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372070677643276</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{331a54f2-38e6-43de-943b-9742b565db8c}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>0</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>2</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68072</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372071155793932</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{722d30ec-406b-423a-b027-d7dd8a306836}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68076</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372070677643276</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c6a5f146-bbad-4cad-8de4-0c3a4d349f77}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>0</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>2</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68077</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372071155793932</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a6c63b22-fa8c-4afc-88ab-3f0a8faf213a}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68081</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{45648f6f-4589-44e3-8959-75b391aa0038}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>0</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>2</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68082</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{dd1e0820-fc15-4492-9403-ef2c61e329bb}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68086</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4d5e5002-239a-4d48-a681-d7c3c49517d1}</filterKey>
|
|
<displayData>
|
|
<name>Port Scanning Prevention Filter</name>
|
|
<description>This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>0</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>2</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68087</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744069414584322</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>Outbound ICMP Error v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>35</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0123}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD</applicableLayer>
|
|
<calloutId>273</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<displayData>
|
|
<name>ALE Resource Assignment v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="16">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>36</layerId>
|
|
</layer>
|
|
<callouts numItems="3">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Edge Traversal ALE Resource Assignment v4 Layer Callout</name>
|
|
<description>Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000014</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</applicableLayer>
|
|
<calloutId>27</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0024}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Notifies the user.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</applicableLayer>
|
|
<calloutId>268</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{58d7275b-2fd2-4b6c-b93a-30037e577d7e}</calloutKey>
|
|
<displayData>
|
|
<name>windefend_resource_assignment_v4</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</applicableLayer>
|
|
<calloutId>296</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="21">
|
|
<item>
|
|
<filterKey>{fec997ae-7462-4ec1-b9af-99c4751fd489}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>9</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0024}</filterType>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67628</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223442268161048576</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e71db8d0-e58f-45fa-8d34-6e66c5ec8cc1}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>9</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0024}</filterType>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67636</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458834745126813696</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{cd49bc81-9428-4bfe-9fad-d20504a480a2}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67663</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11529003905476198400</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d0db3fd9-fa82-4abf-aa82-87a9645636de}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67664</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11529003905476198400</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{69f35305-c344-4543-891f-28168fbd3f31}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Dynamic Host Configuration Protocol (DHCP-In)</name>
|
|
<description>Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9f00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>68</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67677</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11529003905476198400</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{77c9fe79-5402-402e-8226-c8b570fd6388}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In)</name>
|
|
<description>Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>546</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67681</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11529003905476198400</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8235388e-e851-4838-a33f-fb98db5a3e5a}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67773</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376363875846062080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{eeb93afc-0f8e-4b50-b378-4517aeacf07a}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67785</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376363875846062080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8bbc020b-4c16-4c42-9147-0c7f61f2a27b}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67797</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376363875846062080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a2b54f0b-3d87-462c-bfe7-5aff5618a7b3}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67809</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376363875846062080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8db0f20c-e041-4c94-93c3-2acdf0380dc4}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Teams</name>
|
|
<description>Microsoft Teams</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67824</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376363841486323712</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2d6dcea9-f654-406c-bad0-c12935683e86}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67829</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376363875846062080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c5f25e64-ac27-4d08-ac2e-fc083d790752}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67841</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376363875846062080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{68ce3ad4-d6a7-4f3b-94bf-9d7ddbbfd856}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>bb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67852</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11529003871116460032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1e498170-bf78-40d0-8534-89420cdeb047}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>bd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67868</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11529003871116460032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{965c8ce5-bb4c-4ece-9b94-fbab1f02bd61}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>be00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67872</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11529003871116460032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1663d17f-13ac-4339-a87d-0b8177c6a161}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [UDP 5004-5009]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>1f01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5000</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5020</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68214</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11212626031653421056</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2c0936a0-ca0e-45fd-8ca2-f7a00123be5c}</filterKey>
|
|
<displayData>
|
|
<name>WFD ASP Coordination Protocol (UDP-In)</name>
|
|
<description>Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235]</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2201000000000000</data>
|
|
<asString>".......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68234</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11529003905476198400</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d89bb141-b39a-4088-96b4-558cb5f9f818}</filterKey>
|
|
<displayData>
|
|
<name>mDNS (UDP-In)</name>
|
|
<description>Inbound rule for mDNS traffic [UDP]</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2601000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68246</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11529003905476198400</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{26501d40-8df2-4445-9f4b-a8a19f2afeb8}</filterKey>
|
|
<displayData>
|
|
<name>windefend_resource_assignment_v4</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{58d7275b-2fd2-4b6c-b93a-30037e577d7e}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68278</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ba25c88a-4995-4529-bbd9-095462c2ab55}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68285</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376363875846062080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Resource Assignment v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="16">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>37</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<displayData>
|
|
<name>ALE Resource Assignment v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="16">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>38</layerId>
|
|
</layer>
|
|
<callouts numItems="3">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Edge Traversal ALE Resource Assignment v6 Layer Callout</name>
|
|
<description>Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000014</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</applicableLayer>
|
|
<calloutId>28</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0026}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Notifies the user.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</applicableLayer>
|
|
<calloutId>269</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{ced78e5f-1dd1-485a-9d35-7e44cc9d784d}</calloutKey>
|
|
<displayData>
|
|
<name>windefend_resource_assignment_v6</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</applicableLayer>
|
|
<calloutId>297</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="21">
|
|
<item>
|
|
<filterKey>{233dc13e-f91d-4576-8c0a-c258350a7620}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>9</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0026}</filterType>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67632</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223511674839891968</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d6ac0d0d-5259-4e91-b3da-6dd38df859a0}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>9</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0026}</filterType>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67640</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458904151805657088</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{cb5e3e43-13f9-4f37-a3d8-c0a6ee6a157b}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67668</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11528792558725496832</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9c5b7174-b5ba-4ebe-87f3-49d42065c090}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67669</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11528792558725496832</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ccb39a7c-ffcc-41e1-b3d5-5508c22d7ae8}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Dynamic Host Configuration Protocol (DHCP-In)</name>
|
|
<description>Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9f00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>68</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67679</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11528792558725496832</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6bfcb550-a334-493c-bfa9-0fd5778762d3}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In)</name>
|
|
<description>Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>546</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67683</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11528792558725496832</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f1d77b93-024f-4ced-96fa-583e3777c094}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67778</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376434004072071168</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4ad1f317-75d8-4c41-b699-586bdc947b61}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67790</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376434004072071168</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5856855b-110b-411a-9edb-c83af7970e2a}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67802</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376434004072071168</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{449e8fbb-acaf-4cfe-a93c-01c8b5a04e2f}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67814</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376434004072071168</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b0f609a0-8de9-4641-93e8-322951f06806}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Teams</name>
|
|
<description>Microsoft Teams</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67826</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376433729194164224</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{efbc5936-c530-4944-a424-354d0f15516f}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67834</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376434004072071168</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{65a89691-b6bc-453a-ba4f-60b8f2f5afce}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67846</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376434004072071168</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2429f54d-a7e7-428b-8b99-db319e9fbeec}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>bb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67854</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11528792283847589888</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6f59015a-2f44-4527-95c2-ef891e2ee42e}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>bd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67870</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11528792283847589888</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4373e6d8-0cba-416a-8957-5346f3a3810f}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>be00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67874</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11528792283847589888</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e4be4ec1-3874-4bb7-91f4-ef1252a96e4a}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [UDP 5004-5009]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>1f01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5000</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5020</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68217</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11212414684902719488</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{95d5968b-f1ce-43f6-8edd-f24b0776f8b0}</filterKey>
|
|
<displayData>
|
|
<name>WFD ASP Coordination Protocol (UDP-In)</name>
|
|
<description>Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235]</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2201000000000000</data>
|
|
<asString>".......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68237</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11528792558725496832</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c98871d1-4f49-4853-9a6e-35cae1fa3f17}</filterKey>
|
|
<displayData>
|
|
<name>mDNS (UDP-In)</name>
|
|
<description>Inbound rule for mDNS traffic [UDP]</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2601000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68249</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>11528792558725496832</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8c0045d4-35b0-4a88-bf37-3c5bbe7a37bc}</filterKey>
|
|
<displayData>
|
|
<name>windefend_resource_assignment_v6</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{ced78e5f-1dd1-485a-9d35-7e44cc9d784d}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68279</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{16dfd892-4fa5-4dc8-bf0f-2e94ffe6f1ba}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68290</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376434004072071168</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Resource Assignment v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="16">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PROMISCUOUS_MODE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>39</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<displayData>
|
|
<name>ALE Listen v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>40</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Edge Traversal ALE Listen v4 Layer Callout</name>
|
|
<description>Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000014</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V4</applicableLayer>
|
|
<calloutId>29</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0028}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Notifies the user.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V4</applicableLayer>
|
|
<calloutId>270</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="15">
|
|
<item>
|
|
<filterKey>{93f12f2b-665e-44f2-a229-f5af613fe690}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0028}</filterType>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67627</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854775840</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8f1a4c58-25f3-4358-84e9-4aaec8ab1398}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0028}</filterType>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67635</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540960</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{85bce91c-5ad3-4c13-978f-edfd66523835}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67696</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293542535364544</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{18f77a24-0d44-4919-98e7-f42eb1002af3}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67697</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293542535364544</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1a3b3a34-55b4-4791-aa77-28e1c9f4f78a}</filterKey>
|
|
<displayData>
|
|
<name>Wireless Display Infrastructure Back Channel (TCP-In)</name>
|
|
<description>Inbound rule for Wireless Display Infrastructure back channel [TCP]</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\castsrv.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7250</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67709</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293542535364480</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7fb5698e-c641-4fbc-b851-13c666f5e3aa}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67772</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c3711cf1-9bff-4f13-abcb-3ffdc68015d3}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67784</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{fa41fb18-1600-4eb8-a46e-b1e892bdc894}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67796</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0ee2b732-6452-42b4-9a5e-bdb97e3a925a}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67808</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a11e4118-9942-4da1-bdbf-698fde8b5697}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Teams</name>
|
|
<description>Microsoft Teams</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67820</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622912</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{066a6860-5fb4-4dd2-bbc9-8bac48b6a4d4}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67828</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{185af45b-b8b0-4110-a5a3-9732ccf1a36a}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67840</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6ed9f2bc-535f-4575-a1b3-56e98dfc52ad}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68220</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293542535364544</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{86edf865-f5c6-4b10-9eaa-63371a7287a1}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8554</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8558</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68223</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293542379542720</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a8c97be3-77f0-4ea7-b5f8-10d91d382e1e}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68284</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Listen v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>41</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<displayData>
|
|
<name>ALE Listen v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>42</layerId>
|
|
</layer>
|
|
<callouts numItems="2">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Edge Traversal ALE Listen v6 Layer Callout</name>
|
|
<description>Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000014</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V6</applicableLayer>
|
|
<calloutId>30</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e002a}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Notifies the user.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_LISTEN_V6</applicableLayer>
|
|
<calloutId>271</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="15">
|
|
<item>
|
|
<filterKey>{a8568747-7e3e-4077-adc4-4ad699d10d4b}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e002a}</filterType>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67631</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854775840</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9412dbc5-7e4a-4296-9b6b-309a61de48b4}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e002a}</filterType>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67639</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540960</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{05a88866-6122-4377-9ca8-432cbe8f64c2}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67701</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541528731584</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8b44e0b3-d691-4d4b-a7ff-4ab5c957d05e}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67702</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541528731584</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9d45f132-f86f-4c7b-8f71-32000ba2136a}</filterKey>
|
|
<displayData>
|
|
<name>Wireless Display Infrastructure Back Channel (TCP-In)</name>
|
|
<description>Inbound rule for Wireless Display Infrastructure back channel [TCP]</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\castsrv.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7250</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67711</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541528731520</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{89449f5a-57ae-4ae5-ac86-e4b758669e07}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67777</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{aedc9943-eac8-497d-acc6-0e7175b5074b}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67789</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8a3fa42a-2fab-485a-afad-8bcfbf876471}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67801</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{09bda0cc-b7d7-4eea-84a5-587667ae638a}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67813</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{72f3c3d1-c6ff-4dc5-a385-a4cb9aad45f3}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Teams</name>
|
|
<description>Microsoft Teams</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67822</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622912</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f4ed1f0f-7a1a-4025-89e2-38e6bebc3db8}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67833</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b452f283-2ec7-44cd-92aa-7b832d56e019}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67845</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{109e4154-56f4-4c4f-92d4-40cd1dc644ce}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68226</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541528731584</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ea58a6ce-9d6b-46f2-9d4c-a1977a154b5b}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8554</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8558</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68229</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541518992832</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e65cf284-71bb-4869-b2ba-c9a7051d20fc}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
|
|
<filterType>FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68289</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293541461622976</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_LISTEN_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Listen v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>43</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<displayData>
|
|
<name>ALE Receive/Accept v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="35">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>44</layerId>
|
|
</layer>
|
|
<callouts numItems="7">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Inbound Initiate Secure v4 Layer Callout</name>
|
|
<description>Verifies that each incoming connection that is supposed to arrive secure arrives securely.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
|
|
<calloutId>13</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Chimney Offload ALE Receive/Accept v4 Layer Callout</name>
|
|
<description>Enables or disables TCP Chimney Offload for each incoming connection.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
|
|
<calloutId>21</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v4 Layer Callout</name>
|
|
<description>Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
|
|
<calloutId>25</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Templates ALE Receive/Accept v4 Layer Callout</name>
|
|
<description>Applies TCP Template for each incoming connection.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
|
|
<calloutId>35</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Set Option ALE Receive/Accept v4 Layer Callout</name>
|
|
<description>Sets classify options on inbound flows.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
|
|
<calloutId>39</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Policy Silent Mode ALE Receive/Accept v4 Layer Callout</name>
|
|
<description>Audit and log policy for incoming connection.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
|
|
<calloutId>43</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e022c}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Allows secondary connections.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</applicableLayer>
|
|
<calloutId>284</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="114">
|
|
<item>
|
|
<filterKey>{c970a45d-57f9-4e32-a5bd-886a9662641e}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>8388608</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66214</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{716b48eb-0a35-4a76-92ab-1d987230d288}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>8388608</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66218</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a47525e2-725b-4888-8af1-ba5a60c04f4d}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66226</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{13bfd422-6f75-4408-8924-9400ec0cb19c}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66230</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c42f1cd6-3a95-4ae2-a513-793c3ae610c7}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66235</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>35165044736</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3697a558-3ed3-49be-a4c1-c1a4448653b4}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66237</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>35165044736</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d870c96c-75ee-46a6-8a02-8e4401a73423}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Block</name>
|
|
<description>This filter blocks any inbound non-loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66241</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>34359738368</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4137b143-2770-43d4-91a2-55bb0a069830}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Tunnel Exception</name>
|
|
<description>This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66247</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1152921539503456256</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{17043d46-fac2-4561-bca1-0c7a05e95f5f}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Next Hop Tunnel Exception</name>
|
|
<description>This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66249</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1152921539503456256</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4e718c57-c397-4221-9fbb-14fd51701d6a}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound DHCP Exception</name>
|
|
<description>This filter allows for DHCP connections when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>68</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>67</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66251</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1154899560384954368</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{916c0dbf-7cec-40f9-9dd9-a5e68b904510}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Loopback Exception</name>
|
|
<description>This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66599</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerBoottimeFilter</name>
|
|
<description>Boottime filter for App Containers</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4194304</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>66995</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e72646bc-7d3f-4c5c-a679-b3716f8c6cc8}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerBoottimeFilter</name>
|
|
<description>Boottime filter for App Containers</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4194304</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>66997</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{21c48193-9ccd-4faf-9590-99b6e4c8af2c}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter allows non-AppContainers to receive loopback traffic from other non-AppContainers</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>8388608</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67190</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7a5bb72c-0e75-4ad6-ae8a-9ffd591bb744}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter allows non-AppContainers to receive loopback traffic from by policy allowed AppContainers</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>16777216</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67192</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{19a19270-e1ff-433e-a9a7-c2fd8fb46bcb}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter allows an AppContainer to receive loopback traffic from itself</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4194304</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67194</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1ea45d61-721b-47aa-9b19-81422ba8fdec}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter blocks AppContainer loopback traffic</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551614</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67200</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551614</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{558d57ba-cc4e-4bde-8ea0-8120605580b4}</filterKey>
|
|
<displayData>
|
|
<name>Interface Un-quarantine filter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>6755399441055744</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67453</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>4503633987108866</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4ff11138-2d2f-4fcf-a884-d0be3936bc57}</filterKey>
|
|
<displayData>
|
|
<name>Interface Un-quarantine filter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>6755399441055744</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67454</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>4503633987108866</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b1686938-d80f-429d-b7d8-735a34b3605b}</filterKey>
|
|
<displayData>
|
|
<name>Interface Un-quarantine filter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10000001</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689399632855040</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67457</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>4503633987108866</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f708e179-0005-47bc-9659-9c9af4525161}</filterKey>
|
|
<displayData>
|
|
<name>Interface Un-quarantine filter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10000001</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689399632855040</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67458</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>4503633987108866</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3668a51e-18e1-4b90-a348-1b26820075ee}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67630</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854776704</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{996c5681-e762-4131-ba41-a4b2ba434af4}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67638</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540928</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e4bf8fce-257a-409d-82a9-c1d0de1706ef}</filterKey>
|
|
<displayData>
|
|
<name>UWP Default Inbound Block Rule</name>
|
|
<description>This is the UWP Default Inbound Block filter. This filter blocks any inbound packets to UWP apps that do not have the correct capability tokens for listening to a resource.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>9900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{b36473ef-bf42-49b9-ac24-adba245e825c}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67657</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>549755813888</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f6ac8f41-9cbd-478e-97ca-93406509632b}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - IPv6 (IPv6-In)</name>
|
|
<description>Inbound rule required to permit IPv6 traffic for ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) and 6to4 tunnelling services.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9b00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>41</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67661</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10377982941077700608</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{46ea0820-54e9-4671-9ee4-b5efa03e7fb2}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67665</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264690932318208</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9ed57c1d-5a7c-4821-85c1-bb4d5b005495}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67666</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264691737624576</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{20aa0d80-0876-40ab-9060-81fa4852b804}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67667</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264726097362944</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1d948ce2-c67e-4612-9a13-a86146c93899}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Destination Unreachable Fragmentation Needed (ICMPv4-In)</name>
|
|
<description>Destination Unreachable Fragmentation Needed error messages are sent from any node that a packet traverses which is unable to forward the packet because fragmentation was needed and the don't fragment bit was set.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9e00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67676</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378272112635805696</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4a6c385c-4d41-422e-80e2-a0a8ed98e329}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Dynamic Host Configuration Protocol (DHCP-In)</name>
|
|
<description>Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9f00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>68</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>67</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67678</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378272387513712640</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9858d0f0-9bcd-4854-b300-54482931a983}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In)</name>
|
|
<description>Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>546</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>547</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67682</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378272387513712640</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d864789f-7916-44d6-92d2-89c3cb3339ce}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67698</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264690932318208</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{fa6ddfcb-e0e4-4e81-851e-bcc403c08a55}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67699</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264691737624576</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{626051d7-734b-4953-9c98-0b07643b6ca2}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67700</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264726097362944</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{db7d8fea-b0d0-47b8-ac4c-926e2d6fa47f}</filterKey>
|
|
<displayData>
|
|
<name>Wireless Display Infrastructure Back Channel (TCP-In)</name>
|
|
<description>Inbound rule for Wireless Display Infrastructure back channel [TCP]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\castsrv.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7250</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67710</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264416054411264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{be661f2c-e574-4046-8c33-f35b7d29a7e4}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Internet Group Management Protocol (IGMP-In)</name>
|
|
<description>IGMP messages are sent and received by nodes to create, join and depart multicast groups.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ac00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>2</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67747</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10377982941077700608</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ead521c1-9552-4d43-8a5c-ceb57aca1dc8}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67774</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366095343616</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1c30209e-d2ce-4392-9e8f-f377efb005e5}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67775</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366900649984</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{22519d4f-2ea3-4e42-8963-d6f0b7733aa2}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67776</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294401260388352</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{29c7768e-567b-4383-9274-88ce90b281c8}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67786</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366095343616</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d6953602-d25c-44c8-89be-32af54554764}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67787</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366900649984</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1d52280a-5200-4f1b-b9f2-ff576ef4721e}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67788</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294401260388352</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{22d44aac-6653-4e7b-aa73-9e3f59633d4f}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67798</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366095343616</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d6346862-1e03-4aeb-ba63-df5639ea6fec}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67799</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366900649984</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6f8d75fc-f3b5-4016-81e2-4f2df77168cf}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67800</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294401260388352</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c041bcbc-c3b0-4002-9e12-424d925ac610}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67810</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366095343616</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ed0b7196-2d26-4cf8-8de9-ae943554347d}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67811</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366900649984</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d45600c9-f182-43ae-b1ea-40ebdeea9b99}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67812</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294401260388352</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b6cc72ea-22a1-483e-9636-090bb5302940}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Teams</name>
|
|
<description>Microsoft Teams</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67821</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10377982941077700608</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5bd7313e-64c8-4956-a5d5-a598afeeaea0}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Teams</name>
|
|
<description>Microsoft Teams</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67825</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10377982941077700608</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ec36ba3d-18ff-43c9-a323-bd61ebf5cdf9}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67830</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366095343616</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{50aedebf-9228-41e5-826c-880c0dfeeeb9}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67831</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366900649984</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{fce876c5-0650-4cf0-a8e5-32763f4572db}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67832</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294401260388352</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8075d897-3b61-4b0d-a1b7-8cf360304598}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67842</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366095343616</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e2918c6c-304d-4dba-a100-4c19a688541d}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67843</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366900649984</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{41000d2a-eba0-40b3-93b1-42d9352f0b1f}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67844</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294401260388352</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e7abd6b3-64e1-456b-9de4-80bd51c45892}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>bb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67853</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264416054411264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3474e056-188f-44cd-bf0e-f2b9395d00b1}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>bd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67869</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264416054411264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3bba491b-aba5-4198-9599-0560f76b1c4d}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>be00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67873</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10378264416054411264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6236913c-4c2a-430b-817d-4c4fcde825ee}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to CDPSvc port 5050</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c200000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5050</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67878</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{66924806-dccf-403e-97a9-14fcc9d64f9a}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5160</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67888</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1cf98e43-5bb6-4020-8666-ff5dc7a76123}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5040</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5040</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67892</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{215327fd-5d26-4b42-9e18-ee1e1f871285}</filterKey>
|
|
<displayData>
|
|
<name>Block inbound traffic to omadmclient.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ca00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\omadmclient.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{a8b55da6-3aba-41f3-b7ba-443233f64fce}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67894</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>549755813888</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9bce6a19-81a8-4ff2-8fe8-e63940b2f706}</filterKey>
|
|
<displayData>
|
|
<name>Block inbound traffic to deviceenroller.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>cb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\deviceenroller.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{c4e61e5c-3e66-4efb-b22b-87f8e56cf9c2}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67896</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>549755813888</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2ea83abb-f047-4edc-857d-4776be7ddb86}</filterKey>
|
|
<displayData>
|
|
<name>Block inbound traffic to dmcertinst.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\dmcertinst.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{616fdcf3-1169-46b5-8224-cffc7276af2e}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67906</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>549755813888</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{dd658fab-9acd-48c8-9faf-a0e67d88ca4c}</filterKey>
|
|
<displayData>
|
|
<name>DhcpFirewallPolicy</name>
|
|
<description>DhcpFirewallPolicy</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>68</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>67</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67916</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1978846052089856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{38119412-b39e-48a6-8fcd-1e7dedc4be5e}</filterKey>
|
|
<displayData>
|
|
<name>DhcpFirewallPolicy</name>
|
|
<description>DhcpFirewallPolicy</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>546</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>547</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67918</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1978846052089856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f4e952f7-52be-4ea6-abb2-90f88debea25}</filterKey>
|
|
<displayData>
|
|
<name>Allow RPC/TCP traffic to EventLog</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67924</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689691673853952</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c76886bf-c4ec-4208-8833-3b243baba297}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to fdphost port 3702</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>da00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67926</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{01569aae-88e0-4cfd-98c5-714f5a86ee63}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to fdphost port 1900</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>dc00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1900</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67930</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4e359e41-d670-4727-a4df-48984e785c40}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP traffic to AJRouter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>9955</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67940</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{88e8faac-2f47-487a-a93f-709d1cb0bf7b}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to AJRouter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e200000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67942</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689674493984768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ac4aaa1b-a5f2-41fa-b624-39f34a249fe4}</filterKey>
|
|
<displayData>
|
|
<name>Allow Grouping to receive from port 3587</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3587</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67948</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1f67d6c0-f1de-4524-a4a7-8a93b03238b2}</filterKey>
|
|
<displayData>
|
|
<name>Allow PNRP to send to port 3540</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3540</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67952</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c68ac2bf-ad79-4aaf-a764-a9de591a17f3}</filterKey>
|
|
<displayData>
|
|
<name>IPsec Policy Agent service hardening - Remote Management</name>
|
|
<description>Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>eb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67960</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689691673853952</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9b2018aa-486c-4b5e-9a4c-a1b96ecf2cbc}</filterKey>
|
|
<displayData>
|
|
<name>Block all inbound traffic to SearchFilterHost</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ec00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\searchfilterhost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{3a5e8a34-82df-4083-a6ed-87ea8ed3507a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67962</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>549755813888</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{27db903a-7e87-41ff-8a17-31ca20c9fb16}</filterKey>
|
|
<displayData>
|
|
<name>Block all inbound traffic to SearchProtocolHost</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ef00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\searchprotocolhost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{c0cedbe2-34f4-4491-bd19-152a55b1b6e0}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67968</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>549755813888</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{bd84fe34-f5b3-48c8-90f7-3f647e9bebe3}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to SNMPTRAP service</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\snmptrap.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67970</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689674493984768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c718ce9d-2f72-430c-beeb-789fa9d7c5ea}</filterKey>
|
|
<displayData>
|
|
<name>Allow all inbound TCP and RPC to SPPEXTCOMOBJ</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\sppextcomobj.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67972</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689674493984768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{bdc0147f-ebdd-4b25-a20a-5c3ed10cbd3f}</filterKey>
|
|
<displayData>
|
|
<name>TermServiceLOM</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67976</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689674493984768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3ddc2b0e-33e3-417b-a578-019a4df4b502}</filterKey>
|
|
<displayData>
|
|
<name>TermServiceLOM</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4</filterType>
|
|
</action>
|
|
<providerContextKey>{2ea412db-5c9d-4bbd-9af2-4914d2dbfe17}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67977</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d9a39ed3-698d-434e-83e1-f8a75a5b6a31}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming RPC traffic to VDS</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\vds.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67980</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689691673853952</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ff843ce9-c5e3-49a0-84d2-cdfa59928fc7}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>389</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67982</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{810b03cc-8f67-4991-bf02-fe78e19477c2}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>636</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67983</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4e788a24-1c9a-4fe2-bfbc-a7c10bd5bd7e}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to NTP port 123</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>123</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67988</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b14b6b1e-1bfe-4dfd-8a8e-393da4d4b226}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\wbengine.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67992</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689691673853952</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{865a8428-bb5e-4b7b-8473-b06bf1b69edb}</filterKey>
|
|
<displayData>
|
|
<name>Cast to Device streaming server hardening rules for RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0201000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\mdeserver.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>23554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68014</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1970874592788480</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d12a44b6-3150-4214-997f-0735fad61441}</filterKey>
|
|
<displayData>
|
|
<name>Cast to Device streaming server hardening rules for RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0201000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\mdeserver.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>23555</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68015</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1970874592788480</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{690e53fb-c3c2-4e74-a58a-b627852bff69}</filterKey>
|
|
<displayData>
|
|
<name>Cast to Device streaming server hardening rules for RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0201000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\mdeserver.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>23556</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68016</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1970874592788480</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c3b150a5-0e63-4acf-99d8-93fa101c9f4c}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming TCP to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0301000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68020</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689674493984768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{cc829f3a-8ac5-461d-bf9e-b53fa92bf4a6}</filterKey>
|
|
<displayData>
|
|
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0901000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windows media player\wmpnetwk.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68040</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{81b5a3ad-8373-4dda-8234-524b6d6411f7}</filterKey>
|
|
<displayData>
|
|
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0901000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windows media player\wmpnetwk.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68041</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1971149470695424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6c2e5205-ac93-4a93-945a-9d07d7f97ff7}</filterKey>
|
|
<displayData>
|
|
<name>WSH Default Inbound Block</name>
|
|
<description>Blocks all inbound traffic for services who have been network hardened</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3914275374-678031271-1603343729-3906112567-2888048264)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{de04f4bd-a953-47f6-b1b6-eb6e24a546d6}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68047</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>274877906944</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{36e4f41f-09b7-4858-a3f7-1f07b2f62dcf}</filterKey>
|
|
<displayData>
|
|
<name>FTP Inspection Filter</name>
|
|
<description>This filter enables inspection of FTP.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1024</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>65535</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e022c}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68052</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{52c05a69-b7bd-471e-90f6-b4165265dee2}</filterKey>
|
|
<displayData>
|
|
<name>InternetClientServer Inbound Default Rule</name>
|
|
<description>InternetClientServer Inbound Default Rule</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>1c01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>255.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68208</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>824633721848</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{de8c0919-fdae-4263-9186-3209ef7a9203}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [UDP 5004-5009]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>1f01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5000</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5020</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68215</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882588684629049344</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2f69ffa4-769a-4f40-a565-b54847821e5b}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [UDP 5004-5009]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>1f01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5000</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5020</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68216</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882588718988787712</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{11dd8bd8-1210-4a7e-adb2-460cf2b6a1c1}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68221</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882667849466249216</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d9e43dad-f679-4f2f-973d-26827bb8c8d3}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68222</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882667883825987584</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9ce6ee0e-7cfb-4b36-bc70-a57d7a63f100}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8554</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8558</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68224</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882623869001138176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{80750116-2e93-43ec-8465-40d3dbf5c900}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8554</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8558</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68225</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882623903360876544</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e43d0b2d-6a0f-432b-91a1-504f070a7035}</filterKey>
|
|
<displayData>
|
|
<name>WFD ASP Coordination Protocol (UDP-In)</name>
|
|
<description>Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2201000000000000</data>
|
|
<asString>".......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68235</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882675546047643648</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1c5d0851-defc-4241-8f7f-20f4ce925d56}</filterKey>
|
|
<displayData>
|
|
<name>WFD ASP Coordination Protocol (UDP-In)</name>
|
|
<description>Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2201000000000000</data>
|
|
<asString>".......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="9">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68236</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882675580407382016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{353edb90-351b-439f-bb1a-499f3ee0d611}</filterKey>
|
|
<displayData>
|
|
<name>mDNS (UDP-In)</name>
|
|
<description>Inbound rule for mDNS traffic [UDP]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2601000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68247</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882667849466249216</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{acfb0f39-be2d-43a6-a260-1b6ea1aa107d}</filterKey>
|
|
<displayData>
|
|
<name>mDNS (UDP-In)</name>
|
|
<description>Inbound rule for mDNS traffic [UDP]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2601000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68248</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10882667883825987584</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9f4f259a-998a-4cad-b318-aeab2fccb2d1}</filterKey>
|
|
<displayData>
|
|
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2701000000000000</data>
|
|
<asString>'.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68252</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>506382004586020864</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{826bf713-3f53-422d-9ab6-f66251968bdf}</filterKey>
|
|
<displayData>
|
|
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2701000000000000</data>
|
|
<asString>'.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="9">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68253</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>506382038945759232</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f7b10da2-52b3-4496-af84-a4141986b1fb}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming WSD to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2901000000000000</data>
|
|
<asString>).......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68260</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>506374308004626432</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a2e9e943-0681-4a0e-8c58-485b3ceff496}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming WSD to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2901000000000000</data>
|
|
<asString>).......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68261</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>506374342364364800</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0ae65187-1f62-4d22-9fde-4f60caac6393}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming WSD to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2a01000000000000</data>
|
|
<asString>*.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68264</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>506100529609310208</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7184c665-64f2-476c-af5a-01cc74b700da}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming WSD to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2a01000000000000</data>
|
|
<asString>*.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68265</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>506100563969048576</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d69d41e1-ee28-47d3-90a0-4e0eef6a868f}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68286</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366095343616</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4442f710-abac-421f-9d4f-f02939d23c63}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68287</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294366900649984</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d68c9ba7-1425-44da-b537-7642ce5bbe9d}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68288</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376294401260388352</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Receive/Accept v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="35">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>45</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e012d}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD</applicableLayer>
|
|
<calloutId>278</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<displayData>
|
|
<name>ALE Receive/Accept v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="35">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>46</layerId>
|
|
</layer>
|
|
<callouts numItems="7">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Inbound Initiate Secure v6 Layer Callout</name>
|
|
<description>Verifies that each incoming connection that is supposed to arrive secure arrives securely.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
|
|
<calloutId>14</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Chimney Offload ALE Receive/Accept v6 Layer Callout</name>
|
|
<description>Enables or disables TCP Chimney Offload for each incoming connection.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
|
|
<calloutId>22</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v6 Layer Callout</name>
|
|
<description>Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
|
|
<calloutId>26</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Templates ALE Receive/Accept v6 Layer Callout</name>
|
|
<description>Applies TCP Template for each incoming connection.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
|
|
<calloutId>36</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Set Option ALE Receive/Accept v6 Layer Callout</name>
|
|
<description>Sets classify options on inbound flows.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
|
|
<calloutId>40</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_RECV_ACCEPT_LAYER_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Policy Silent Mode ALE Receive/Accept v6 Layer Callout</name>
|
|
<description>Audit and log policy for incoming connection.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
|
|
<calloutId>44</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e022e}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Allows secondary connections.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</applicableLayer>
|
|
<calloutId>285</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="202">
|
|
<item>
|
|
<filterKey>{dc95b53e-01cf-4058-821d-350b3d0d4676}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66210</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1153167795211468800</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f444c576-6e60-4ea2-9faa-80d57ed12cd2}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66211</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1153167795211468800</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0c3be01b-fe70-4cc4-89dc-c07996b67e6d}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>8388608</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66215</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1165065e-4996-4338-abaf-4b8556b4d431}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>8388608</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66219</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66227</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{cbfb56db-3c85-4543-9bc2-76ea28cdd74e}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66231</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2dd96961-5757-434f-b617-34e732517c0e}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66232</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>8992587776</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{375fb39b-08c6-40f2-bdf2-08fa63f970a2}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66233</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>8992587776</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2db25e6c-f07a-44f4-b6c8-50a330d2790b}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66234</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>8992587776</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b6fdab6b-dcc6-43e3-99ce-7aeca65063a4}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66236</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>8992587776</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b02a4013-b6b5-4859-9168-1e3299e43b24}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Block</name>
|
|
<description>This filter blocks any inbound non-loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66240</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>8589934592</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8b50e2ec-7cf0-4b71-b42e-5b0536f6cab8}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Tunnel Exception</name>
|
|
<description>This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66246</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1152921513465217024</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3180114b-8338-4740-9a16-444134ad62f4}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Next Hop Tunnel Exception</name>
|
|
<description>This filter allows for tunneling when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66248</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1152921513465217024</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{567d3836-3f5b-4067-b9c4-952f677010a2}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Neighbor Discovery Exception</name>
|
|
<description>This filter allows for Neighbor Discovery when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66250</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1153167795211468800</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3a90a266-1519-4d23-911b-e84cd0f02ab8}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound DHCP Exception</name>
|
|
<description>This filter allows for DHCP connections when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>546</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>547</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66252</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1153169727946752000</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0593d9b7-8e2b-44b1-9f9e-2831da1c9bd9}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Loopback Exception</name>
|
|
<description>This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66598</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{70694559-714a-4a38-a0cd-51439e06f1d8}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound ICMP Exception</name>
|
|
<description>This filter allows for ICMP connections when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="4">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>1</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66602</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1225225526688350208</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{84750a0c-b836-48e3-ab80-104985c857db}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerBoottimeFilter</name>
|
|
<description>Boottime filter for App Containers</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_BOOTTIME</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4194304</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>66996</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b98b75dc-17c0-4e84-bd4e-2080527ca6a6}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerBoottimeFilter</name>
|
|
<description>Boottime filter for App Containers</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4194304</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>66998</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5e48f4ad-9f6c-4c4e-a83a-d1ac10317436}</filterKey>
|
|
<displayData>
|
|
<name>Teredo socket option opt out block filter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>{c698301d-9129-450c-937c-f4b834bfb374}</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>{7b6b11f6-cbb5-433c-ae06-6a4f0076e49e}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67005</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6109847e-3461-46a7-8bbb-58bd48643bf0}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter allows non-AppContainers to receive loopback traffic from other non-AppContainers</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>8388608</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67191</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1f1a43af-2fa5-4f1a-8d8e-395b07d53b24}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter allows non-AppContainers to receive loopback traffic from by policy allowed AppContainers</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>16777216</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67193</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a974e5b7-ff22-43d9-a813-01c5d1283b2e}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter allows an AppContainer to receive loopback traffic from itself</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4194304</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67195</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e3ac824d-4754-4603-80fb-48fe7450e46b}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter blocks AppContainer loopback traffic</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551614</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67201</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551614</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{36bb2266-0f81-4937-af6b-63086254e9df}</filterKey>
|
|
<displayData>
|
|
<name>Interface Un-quarantine filter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>6755399441055744</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67455</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>562958543355906</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d3e85111-30f5-4ff0-850f-8622624aadcf}</filterKey>
|
|
<displayData>
|
|
<name>Interface Un-quarantine filter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>0</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>6755399441055744</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67456</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>562958543355906</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8c9a53ad-9d03-4280-9e0a-53754eb303bd}</filterKey>
|
|
<displayData>
|
|
<name>Interface Un-quarantine filter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10000002</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689399632855040</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67459</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>562958543355906</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8540bba7-40c4-4959-85fd-c082688a1176}</filterKey>
|
|
<displayData>
|
|
<name>Interface Un-quarantine filter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>0</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10000002</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1689399632855040</uint64>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67460</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>562958543355906</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6fc5fe31-8779-4b15-9576-3ba7ff0b0ce4}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67634</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854776768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{569702e8-0383-45e2-a938-743a0b269a89}</filterKey>
|
|
<displayData>
|
|
<name>Query User</name>
|
|
<description>Prompt the User for a decision corresponding to Inbound Traffic. This filter blocks any inbound packets for which there is no explicit rule to allow the packet, unless the user has allowed through the Query User pop up.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67642</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540928</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c833a355-c4ff-4504-ba03-e56b2edcf0b2}</filterKey>
|
|
<displayData>
|
|
<name>UWP Default Inbound Block Rule</name>
|
|
<description>This is the UWP Default Inbound Block filter. This filter blocks any inbound packets to UWP apps that do not have the correct capability tokens for listening to a resource.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>9900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{b36473ef-bf42-49b9-ac24-adba245e825c}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67658</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1c63c63e-acc4-4ef8-b31e-a3c7156292df}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - IPv6 (IPv6-In)</name>
|
|
<description>Inbound rule required to permit IPv6 traffic for ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) and 6to4 tunnelling services.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9b00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>41</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67662</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376504785133109248</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b9346349-afa6-45c1-875e-5e12437b1648}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67670</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540038224674816</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e0e890e5-0dbb-449d-926f-36ecc0d32307}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67671</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540038627328000</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{79923371-5423-4aa7-9d60-86afaac5ce75}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67672</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540047217262592</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e67d1661-76e2-4fdf-bbab-5f1cd28e3ea4}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67673</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540038627328000</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{72a57651-9ca9-4550-ba15-cb5c797b3281}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (UDP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9c00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67674</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540047217262592</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9ee8af53-7d0c-48f1-892e-3038f67c8771}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Router Advertisement (ICMPv6-In)</name>
|
|
<description>Router Advertisement messages are sent by routers to other nodes for stateless auto-configuration.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9d00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67675</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10664770345656909824</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{269d6a27-dcd7-4d83-8e64-34e06f1fab75}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Dynamic Host Configuration Protocol (DHCP-In)</name>
|
|
<description>Allows DHCP (Dynamic Host Configuration Protocol) messages for stateful auto-configuration.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9f00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>68</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>67</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67680</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376541962370023424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4f4f8d89-0d09-4170-91e5-b50e05fd12ba}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Dynamic Host Configuration Protocol for IPv6(DHCPV6-In)</name>
|
|
<description>Allows DHCPV6 (Dynamic Host Configuration Protocol for IPv6) messages for stateful and stateless configuration.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>546</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>547</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67684</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376541962370023424</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{dc4fed41-3e88-48ec-8363-d1dabe968953}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Solicitation (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67685</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{24a4ff08-78cb-425a-8412-de0c6eee513f}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Solicitation (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67686</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{925f3a0e-53c9-4c55-8506-1a50be54a688}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Solicitation (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67687</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b0c5f46c-f20b-455a-94a5-ba616b03ba89}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Solicitation (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67688</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7c5bf10d-2519-47ac-9864-28272c35ecd6}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Solicitation (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Solicitations are sent by nodes to discover the link-layer address of another on-link IPv6 node.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67689</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b0a2ee9b-60e1-4c3a-a2e8-db6ffaec87e2}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67703</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540038224674816</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e5c30a1f-bd12-46f2-9eb5-0dfa08e13499}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67704</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540038627328000</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0921d09f-c82d-41d2-814f-6ac23cfb74f5}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67705</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540047217262592</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{31d9ed8a-a509-4a04-a9fc-c09be2ae87af}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67706</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540038627328000</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{78a6c883-2926-4fa7-82ed-335f51c3b5bd}</filterKey>
|
|
<displayData>
|
|
<name>Delivery Optimization (TCP-In)</name>
|
|
<description>Inbound rule to allow Delivery Optimization to connect to remote endpoints</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3055155277-3816794035-3994065555-2874236192-2193176987)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7680</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67707</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376540047217262592</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{076c0bad-60b8-4a49-a4ce-83bdc9a879f0}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Router Solicitation (ICMPv6-In)</name>
|
|
<description>Router Solicitation messages are sent by nodes seeking routers to provide stateless auto-configuration.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67708</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{45791038-5827-4a2e-993b-7ebfdccffa6a}</filterKey>
|
|
<displayData>
|
|
<name>Wireless Display Infrastructure Back Channel (TCP-In)</name>
|
|
<description>Inbound rule for Wireless Display Infrastructure back channel [TCP]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0063006100730074007300720076002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\castsrv.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7250</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67712</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0f24cc1b-3e3d-44e1-90a0-f20ac3e4462e}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Advertisement (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67713</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{52dc6841-c31e-4d63-bc57-4e0e2b9b9671}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Advertisement (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67714</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{42f19b9f-5956-45b5-a51c-5b5267d5005a}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Advertisement (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67715</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2d1be467-dab7-4309-89bc-0e16efbeb1e7}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Advertisement (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67716</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c094b7da-b5e2-4cac-bf03-d3f8dd685948}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Neighbour Discovery Advertisement (ICMPv6-In)</name>
|
|
<description>Neighbour Discovery Advertisement messages are sent by nodes to notify other nodes of link-layer address changes or in response to a Neighbour Discovery Solicitation request.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67717</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4aee5ef2-93d5-46e6-bee0-725d8e4cdc07}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Parameter Problem (ICMPv6-In)</name>
|
|
<description>Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67730</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4887adbb-3a7a-48f0-a6b1-9243969c1d1c}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Parameter Problem (ICMPv6-In)</name>
|
|
<description>Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67731</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{56a02554-23d2-4984-95a9-2f461cc4fa66}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Parameter Problem (ICMPv6-In)</name>
|
|
<description>Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67732</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{13668b24-1745-4eef-8097-a78f1683cf37}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Parameter Problem (ICMPv6-In)</name>
|
|
<description>Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67733</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d9f3965a-d5ba-402c-be4b-fd46d258c1e8}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Parameter Problem (ICMPv6-In)</name>
|
|
<description>Parameter Problem error messages are sent by nodes as a result of incorrectly generated packets.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>4</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67734</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{630130e6-d0ee-4f95-917f-727386eef3d2}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Packet Too Big (ICMPv6-In)</name>
|
|
<description>Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>2</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67735</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{24a965e8-7b7e-4248-b6fa-b4f93990c49a}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Packet Too Big (ICMPv6-In)</name>
|
|
<description>Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>2</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67736</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1f160125-9b36-460c-a743-a7e17c45ed4f}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Packet Too Big (ICMPv6-In)</name>
|
|
<description>Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>2</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67737</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5cdc61d6-8697-400d-91c3-ff55d00ff9a9}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Packet Too Big (ICMPv6-In)</name>
|
|
<description>Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>2</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67738</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{412c57e1-2038-40cf-a4eb-1006cc161782}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Packet Too Big (ICMPv6-In)</name>
|
|
<description>Packet Too Big error messages are sent from any node that a packet traverses which is unable to forward the packet because the packet is too large for the next link.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>a900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>2</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67739</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{33ea4c7f-33e0-4ebc-934e-5c4d8c6bb21e}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Destination Unreachable (ICMPv6-In)</name>
|
|
<description>Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ab00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67742</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5c2001c6-fed1-458f-a2e5-f05059ba33b3}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Destination Unreachable (ICMPv6-In)</name>
|
|
<description>Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ab00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67743</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{11917a18-01cd-4f40-94a2-c11700ffd140}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Destination Unreachable (ICMPv6-In)</name>
|
|
<description>Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ab00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67744</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{65a7e69a-8dda-48bf-8f7f-77f85ef66d4d}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Destination Unreachable (ICMPv6-In)</name>
|
|
<description>Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ab00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67745</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0c139d5c-00c0-40fe-a291-119da3eb65a1}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Destination Unreachable (ICMPv6-In)</name>
|
|
<description>Destination Unreachable error messages are sent from any node that a packet traverses which is unable to forward the packet for any reason except congestion.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ab00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67746</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d91c02d3-8acf-4ca8-b00e-c70abeb4e4f4}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Internet Group Management Protocol (IGMP-In)</name>
|
|
<description>IGMP messages are sent and received by nodes to create, join and depart multicast groups.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ac00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>2</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67748</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376504785133109248</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8e67bf87-b3ab-4faa-966d-0374819472f1}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Time Exceeded (ICMPv6-In)</name>
|
|
<description>Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67761</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{03d3765e-5cbb-482f-92e2-b1c2813d43a0}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Time Exceeded (ICMPv6-In)</name>
|
|
<description>Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67762</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7e3d00b3-7372-4d01-9d99-0ad72294a64e}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Time Exceeded (ICMPv6-In)</name>
|
|
<description>Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67763</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f4ad030a-de57-4da0-aae8-34007c10742c}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Time Exceeded (ICMPv6-In)</name>
|
|
<description>Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67764</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969907851264</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{db8b7e5e-dfe4-4a20-9ce2-94970713653f}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Time Exceeded (ICMPv6-In)</name>
|
|
<description>Time Exceeded error messages are generated from any node that a packet traverses if the Hop Limit value is decremented to zero at any point on the path.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67765</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539978497785856</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6fe6052c-9f1b-449f-80e6-1933bd00c2bd}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67779</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293747620052992</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{25113d41-4bfd-4f42-b8ed-0782825d5cef}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67780</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e33d2046-cd76-4858-82c6-4604a02f215f}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67781</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c67dd978-8cee-43a5-b7c5-7394d13639dd}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67782</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{577f1fbd-6697-4374-831d-ab4957b5d82a}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/DisplayName}</name>
|
|
<description>@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.Win32WebViewHost/resources/Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67783</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{497778bf-d906-447e-97c6-3d90e01faf13}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67791</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293747620052992</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{fa37a31f-edf8-45f1-a12a-3979b049b980}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67792</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7348c729-bea7-4ce3-9126-91bacbf060ab}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67793</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{245b69e4-1a3a-4fe8-9121-f716a7758498}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67794</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{06682e90-222d-41d9-a82a-c80c77bd5d24}</filterKey>
|
|
<displayData>
|
|
<name>XING</name>
|
|
<description>XING</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-830604253-3178213212-3804702845-3552981612-1670190244-297742492-2307346640</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67795</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f8fe4921-4cac-4e53-9a94-6f3ba592041f}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67803</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293747620052992</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{54e08d95-dd62-45d7-89d8-aaa4b6ef259b}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67804</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{219df051-7115-4bae-844c-ff5b93b401c5}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67805</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{bfec4abb-9fae-4382-9946-0f22c6cc800a}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67806</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7951db55-918d-43fc-b66a-21a5f9c754e5}</filterKey>
|
|
<displayData>
|
|
<name>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_DisplayName}</name>
|
|
<description>@{microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxoutlookintl/AppManifest_OutlookDesktop_Description}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67807</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2743ed06-9818-463f-8aa4-b97a298ee1e3}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67815</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293747620052992</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6e4a1c0a-729d-431d-9f8d-0a1df4f16f2f}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67816</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{173e4b5d-3445-413c-a0a6-f1900681f228}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67817</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f5f65248-7c4f-4a2a-bf44-ef3d8385796f}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67818</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{95150dd6-5f6b-4d72-a721-bd90f0f3e1e3}</filterKey>
|
|
<displayData>
|
|
<name>Xbox Game Bar</name>
|
|
<description>Xbox Game Bar</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67819</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5e458804-9d6b-4374-aeb0-0fab8ebfa394}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Teams</name>
|
|
<description>Microsoft Teams</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67823</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376504785133109248</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f767a292-c59e-40a5-a090-99dbd8574026}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Teams</name>
|
|
<description>Microsoft Teams</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c006d006900630072006f0073006f00660074007400650061006d0073005f00320032003000300036002e003600300030002e0031003100330033002e0037003400300039005f007800360034005f005f003800770065006b007900620033006400380062006200770065005c006d0073007400650061006d0073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windowsapps\microsoftteams_22006.600.1133.7409_x64__8wekyb3d8bbwe\msteams.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67827</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376504785133109248</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5c28dd7c-af06-4a4c-876c-0dc6ab29ee70}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67835</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293747620052992</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{559be0e2-e31c-4860-b8f4-f535b5f067ba}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67836</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{16aba0dc-3359-47fe-acf5-496ac83cbaa8}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67837</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{54f2e6d9-ec87-40ef-91a5-e48f51fbce78}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67838</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c176404f-b6b6-470b-b3be-7c5db41a3c08}</filterKey>
|
|
<displayData>
|
|
<name>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</name>
|
|
<description>@{Microsoft.Windows.Photos_2021.21120.8011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Windows.Photos/Resources/AppStoreName}</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>b900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67839</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0bfafb37-da2b-4b57-96c4-dd5e14ef9b9b}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67847</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293747620052992</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2756a9a2-8940-469d-b0e4-d093e24b8737}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67848</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0b19d824-b94d-4b8c-8eb0-fb82a74f4c5b}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67849</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ee6e661b-040e-43b2-9443-46047eaf059e}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67850</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{42de4209-2a60-449b-81c9-feda0c9914be}</filterKey>
|
|
<displayData>
|
|
<name>Cortana</name>
|
|
<description>Cortana</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ba00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67851</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c808a57d-2fb7-4e7d-a772-5667a9bdbc70}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>bb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00350036005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.56\msedgewebview2.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67855</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{639e9c00-79c8-4dfb-a3f1-dd6713b27868}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>bd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c0065006400670065005c006100700070006c00690063006100740069006f006e005c006d00730065006400670065002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edge\application\msedge.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67871</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1256e94d-6137-4f0d-b73a-f8f9ccb8d64a}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Edge (mDNS-In)</name>
|
|
<description>Inbound rule for Microsoft Edge to allow mDNS traffic.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>be00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073002000280078003800360029005c006d006900630072006f0073006f00660074005c00650064006700650077006500620076006900650077005c006100700070006c00690063006100740069006f006e005c00390038002e0030002e0031003100300038002e00360032005c006d0073006500640067006500770065006200760069006500770032002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files (x86)\microsoft\edgewebview\application\98.0.1108.62\msedgewebview2.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67875</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376539969505198080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5eb6cad8-1d8a-4c51-b026-807f3e3d92e0}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to CDPSvc port 5050</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c200000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5050</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67879</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{211c67b6-5dec-468d-9bf9-564f606ad8be}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5160</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67889</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d9f11c8c-075e-4271-8012-655bb3f9dde1}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP traffic to CDPSvc from any port to port 5040</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5040</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67893</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{42b88eb0-34e6-478f-908b-585607fbe41a}</filterKey>
|
|
<displayData>
|
|
<name>Block inbound traffic to omadmclient.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ca00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\omadmclient.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{a8b55da6-3aba-41f3-b7ba-443233f64fce}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67895</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{475d5508-5d3a-46d5-9805-e407589473ec}</filterKey>
|
|
<displayData>
|
|
<name>Block inbound traffic to deviceenroller.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>cb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\deviceenroller.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{c4e61e5c-3e66-4efb-b22b-87f8e56cf9c2}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67897</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f0faf4fb-252e-47b9-af71-f9a81a7a650d}</filterKey>
|
|
<displayData>
|
|
<name>Block inbound traffic to dmcertinst.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\dmcertinst.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{616fdcf3-1169-46b5-8224-cffc7276af2e}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67907</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{62af150d-b92a-423a-ab03-b55021e030ef}</filterKey>
|
|
<displayData>
|
|
<name>DhcpFirewallPolicy</name>
|
|
<description>DhcpFirewallPolicy</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>68</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>67</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67917</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>248420908400640</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e53b388f-16cd-408e-8e6b-1aa8dfdc1ccc}</filterKey>
|
|
<displayData>
|
|
<name>DhcpFirewallPolicy</name>
|
|
<description>DhcpFirewallPolicy</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>546</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>547</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67919</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>248420908400640</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{388a863a-333e-4270-8ea8-3756df7eb475}</filterKey>
|
|
<displayData>
|
|
<name>Allow RPC/TCP traffic to EventLog</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67925</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>211316685930496</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ac41a204-b76a-46b4-b943-a8c24d3c5336}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to fdphost port 3702</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>da00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67927</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{cb0601b2-92ec-40b8-8422-c92875ed2d56}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to fdphost port 1900</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>dc00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1900</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67931</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8e76e740-04c4-4d35-a298-11f7dc596749}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP traffic to AJRouter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>9955</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67941</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{19ed4871-1493-432b-8d8c-0ccc59f25f6d}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to AJRouter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e200000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67943</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>211312390963200</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{84c3250b-945e-4d9e-821e-09efa2c38757}</filterKey>
|
|
<displayData>
|
|
<name>Allow Grouping to receive from port 3587</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3587</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67949</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{75fe5296-4bc2-4582-a285-7442b870bf8e}</filterKey>
|
|
<displayData>
|
|
<name>Allow PNRP to send to port 3540</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3540</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67953</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ad422266-d71d-4380-b44a-fb3e2e95868b}</filterKey>
|
|
<displayData>
|
|
<name>IPsec Policy Agent service hardening - Remote Management</name>
|
|
<description>Allow IPsec Policy Agent inbound RPC/TCP traffic for Remote Management</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>eb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67961</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>211316685930496</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{19682e8b-d911-49dc-900a-54cef7765f40}</filterKey>
|
|
<displayData>
|
|
<name>Block all inbound traffic to SearchFilterHost</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ec00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\searchfilterhost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{3a5e8a34-82df-4083-a6ed-87ea8ed3507a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67963</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2be90617-8637-421f-acca-fb35be82a866}</filterKey>
|
|
<displayData>
|
|
<name>Block all inbound traffic to SearchProtocolHost</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ef00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800700072006f0074006f0063006f006c0068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\searchprotocolhost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{c0cedbe2-34f4-4491-bd19-152a55b1b6e0}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67969</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8dba5a64-72a1-4fcd-bf10-7350fdfe0e60}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to SNMPTRAP service</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006e006d00700074007200610070002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\snmptrap.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67971</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>211312390963200</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{031039e8-157e-4c49-a1b7-831802af44ea}</filterKey>
|
|
<displayData>
|
|
<name>Allow all inbound TCP and RPC to SPPEXTCOMOBJ</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\sppextcomobj.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67973</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>211312390963200</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0adc1095-75ad-4dbe-a1ff-a2cfa50c9182}</filterKey>
|
|
<displayData>
|
|
<name>TermServiceLOM</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67978</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>211312390963200</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{569847e2-c2ad-471a-a0aa-7db6eda39cce}</filterKey>
|
|
<displayData>
|
|
<name>TermServiceLOM</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6</filterType>
|
|
</action>
|
|
<providerContextKey>{2ea412db-5c9d-4bbd-9af2-4914d2dbfe17}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67979</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{aeb06403-14b2-4f11-911c-d2e71406b781}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming RPC traffic to VDS</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007600640073002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\vds.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67981</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>211316685930496</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{06ec84e9-0aaf-4282-b849-ffe57c1b0d6a}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>389</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67984</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e32e6791-5d61-4ba0-a2c7-6b02831e6a45}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound TCP ports 389 and 636 traffic for vmicheartbeat</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>636</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67985</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c6c6d63a-882b-4f39-8ceb-36c8f7555219}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound UDP traffic to NTP port 123</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>123</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67989</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0c2c073b-bf6b-4c9f-9606-9ce2126c2f50}</filterKey>
|
|
<displayData>
|
|
<name>Allow inbound RPC traffic to the Block Level Backup service (wbengine) over TCP</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c007700620065006e00670069006e0065002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\wbengine.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67993</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>211316685930496</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7414eaee-1713-4f1a-836e-a33cf8e7f5ee}</filterKey>
|
|
<displayData>
|
|
<name>Cast to Device streaming server hardening rules for RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0201000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\mdeserver.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>23554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68017</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246428043575296</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{74e34cf5-b726-4da8-b473-4740ac1dacfe}</filterKey>
|
|
<displayData>
|
|
<name>Cast to Device streaming server hardening rules for RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0201000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\mdeserver.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>23555</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68018</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246428043575296</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7e0a5145-d1e5-42f7-9d4e-d4dd9196b7b0}</filterKey>
|
|
<displayData>
|
|
<name>Cast to Device streaming server hardening rules for RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Cast to Device streaming server</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0201000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006d00640065007300650072007600650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\mdeserver.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>23556</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68019</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246428043575296</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{54d6e8b9-dec2-46f8-a998-91264ad65362}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming TCP to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0301000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68021</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>211312390963200</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{80d42d94-a6d0-4a5d-b8c6-20cdeda245cb}</filterKey>
|
|
<displayData>
|
|
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0901000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windows media player\wmpnetwk.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68042</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b4aeacd5-c926-446e-addd-dc86b9979b64}</filterKey>
|
|
<displayData>
|
|
<name>Windows Media Player Network Sharing Service service hardening - RTSP</name>
|
|
<description>Allow incoming RTSP connections to the Windows Media Player Network Sharing Service</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0901000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730020006d006500640069006100200070006c0061007900650072005c0077006d0070006e006500740077006b002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windows media player\wmpnetwk.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68043</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>246496763052032</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ec51a54f-1281-48b4-9a56-386529896692}</filterKey>
|
|
<displayData>
|
|
<name>WSH Default Inbound Block</name>
|
|
<description>Blocks all inbound traffic for services who have been network hardened</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-3914275374-678031271-1603343729-3906112567-2888048264)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{de04f4bd-a953-47f6-b1b6-eb6e24a546d6}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68046</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>68719476736</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{27d0382a-b7fd-4536-a470-71a5ea27cb99}</filterKey>
|
|
<displayData>
|
|
<name>FTP Inspection Filter</name>
|
|
<description>This filter enables inspection of FTP.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1024</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>65535</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e022e}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68053</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{58fd9e51-dfb2-4b8b-9f4e-fbe76618a080}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68088</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{98b70176-3bcc-4734-b93b-4eaeeeb6a37b}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68089</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a300f22a-ae94-4b5f-aa5f-33ff9fbbfce7}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68090</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d90cbaa3-eaf3-4021-a70a-c130bc327519}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68091</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c364ce80-e89b-489f-b7ab-ba5da061dc31}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68092</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{941565df-dade-42f5-b5cb-ed48e857a508}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68093</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{00ea3695-8388-45b7-9aaf-49947f97dec5}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68094</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{73508c22-0149-461b-b1f2-3cdc929feea1}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68095</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{198ff4f2-5d0a-40bf-b43e-1d4684b11b65}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68096</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7f8a98cc-cc4b-410d-ad3c-2d0dd1aebe0e}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68097</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d2e40d8a-cc87-4ad1-b496-bd28937f886e}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68098</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6c68a273-fac7-4be9-a9d1-fe56ffa5981d}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>135</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68099</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5f7e61e7-2af6-4f12-9a07-5522f61f4b86}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68100</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{19590b9d-8cbb-42c2-9a7a-ab0775ecd93b}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68101</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{29f7b740-30f9-4972-adc7-cbfa92803082}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68102</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6dfc4acb-0027-4d5a-b527-f452291ec069}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68103</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b1e42ad1-a690-42c2-abf2-57ce5aded578}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68104</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{eb76a71a-600b-4489-be24-d5cf94512966}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68105</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{fed10772-760a-4002-a372-699758835bb5}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68106</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0ce6b8ef-3f7b-44c7-b923-538b5c6f85cf}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68107</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{40e896f7-d6fa-48a0-8d3d-b89e5c480196}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68108</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7bead13c-ef8a-406c-b796-15424030645a}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68109</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0ef1dbc6-5f1c-46fa-a4be-7b601943da68}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68110</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{56610786-c7ca-41fc-abce-e661c467a692}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>134</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68111</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0677b532-ed94-451f-a801-b69c51ae8932}</filterKey>
|
|
<displayData>
|
|
<name>InternetClientServer Inbound Default Rule</name>
|
|
<description>InternetClientServer Inbound Default Rule</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>1c01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68209</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>206158431224</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1582a99d-c924-4a69-8c31-38c3e811b06e}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [UDP 5004-5009]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>1f01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5000</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5020</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68218</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700788216413290496</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{77733464-f8b8-4139-82ce-d711bf56aa0c}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [UDP 5004-5009]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open UDP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>1f01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5000</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5020</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68219</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700788225003225088</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b12e5bff-8fa5-42bd-a2d5-9904d7ca9d03}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68227</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799211529568256</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{bb69d143-1985-454a-b089-308e8e8dc13e}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>554</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68228</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799220119502848</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5acc61db-fd65-4cb1-bc32-8ca12e976908}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8554</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8558</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68230</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700792614459801600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{aab1ec78-7ee4-49d1-98fc-8c3b631ae069}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Media Foundation Network Source IN [TCP 554]</name>
|
|
<description>InBound Rule for the Microsoft Media Foundation's Capture SVC to open TCP port to enable RTSP</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2001000000000000</data>
|
|
<asString> .......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3915894004-2104103821-3047269622-1811662266-774708259)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8554</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>8558</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68231</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700792623049736192</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{35a7aaa5-1838-4ae3-817a-69cb1c19cd18}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Multicast Listener Done (ICMPv6-In)</name>
|
|
<description>Multicast Listener Done messages inform local routers that there are no longer any members remaining for a specific multicast address on the subnet.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2101000000000000</data>
|
|
<asString>!.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>132</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68232</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799142810091520</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f93ea8eb-52e1-42c1-9ad4-7c36ffb021d6}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Multicast Listener Done (ICMPv6-In)</name>
|
|
<description>Multicast Listener Done messages inform local routers that there are no longer any members remaining for a specific multicast address on the subnet.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2101000000000000</data>
|
|
<asString>!.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>132</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68233</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799151400026112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a06c507e-0e22-4963-8f44-87618653a39c}</filterKey>
|
|
<displayData>
|
|
<name>WFD ASP Coordination Protocol (UDP-In)</name>
|
|
<description>Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2201000000000000</data>
|
|
<asString>".......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68238</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700801135674916864</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{33989d24-4033-4bd0-b74f-9bcf3d09dbeb}</filterKey>
|
|
<displayData>
|
|
<name>WFD ASP Coordination Protocol (UDP-In)</name>
|
|
<description>Inbound rule for the WLAN Service to allow coordination protocol for WFD Service sessions [UDP 7235]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2201000000000000</data>
|
|
<asString>".......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="9">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68239</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700801144264851456</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6a14e12f-4cc9-4ba8-8087-ce034ce64aa9}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Multicast Listener Report v2 (ICMPv6-In)</name>
|
|
<description>Multicast Listener Report v2 message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2301000000000000</data>
|
|
<asString>#.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>143</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68240</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799142810091520</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b39cb12b-597e-47f5-8e3f-9dd402f046f7}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Multicast Listener Report v2 (ICMPv6-In)</name>
|
|
<description>Multicast Listener Report v2 message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2301000000000000</data>
|
|
<asString>#.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>143</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68241</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799151400026112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{58df562c-0db6-447a-9f51-a1a9ca36a7da}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Multicast Listener Query (ICMPv6-In)</name>
|
|
<description>An IPv6 multicast-capable router uses the Multicast Listener Query message to query a link for multicast group membership.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2401000000000000</data>
|
|
<asString>$.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>130</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68242</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799142810091520</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{422c78ee-d74f-4287-92cb-f7ebd9b13d7f}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Multicast Listener Query (ICMPv6-In)</name>
|
|
<description>An IPv6 multicast-capable router uses the Multicast Listener Query message to query a link for multicast group membership.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2401000000000000</data>
|
|
<asString>$.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>130</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68243</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799151400026112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c86577a4-f769-4666-8ef8-da0d20234c50}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Multicast Listener Report (ICMPv6-In)</name>
|
|
<description>The Multicast Listener Report message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2501000000000000</data>
|
|
<asString>%.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>131</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68244</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799142810091520</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7aebe37a-9063-4a41-bfe2-c5f36fc48aa1}</filterKey>
|
|
<displayData>
|
|
<name>Core Networking - Multicast Listener Report (ICMPv6-In)</name>
|
|
<description>The Multicast Listener Report message is used by a listening node to either immediately report its interest in receiving multicast traffic at a specific multicast address or in response to a Multicast Listener Query.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2501000000000000</data>
|
|
<asString>%.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>530079007300740065006d000000</data>
|
|
<asString>System</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>131</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68245</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799151400026112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c60857b2-86f1-4479-ac73-2d5cc8d478cb}</filterKey>
|
|
<displayData>
|
|
<name>mDNS (UDP-In)</name>
|
|
<description>Inbound rule for mDNS traffic [UDP]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2601000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68250</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799211529568256</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{47eea8d3-5188-4143-acdf-202833261322}</filterKey>
|
|
<displayData>
|
|
<name>mDNS (UDP-In)</name>
|
|
<description>Inbound rule for mDNS traffic [UDP]</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2601000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-859482183-879914841-863379149-1145462774-2388618682)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5353</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68251</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10700799220119502848</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{efc20c2d-6c5a-4e5b-8a34-98b4483999a2}</filterKey>
|
|
<displayData>
|
|
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2701000000000000</data>
|
|
<asString>'.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68254</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>324507594213294080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{35413795-c6d4-4215-a986-4f6430c1d790}</filterKey>
|
|
<displayData>
|
|
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-In)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2701000000000000</data>
|
|
<asString>'.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="9">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68255</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>324507602803228672</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d6b96843-703f-4584-bd03-4031d5af55ea}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming WSD to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2901000000000000</data>
|
|
<asString>).......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68262</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>324505670067945472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2cbbf8db-968e-4981-9676-5e84aba688c6}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming WSD to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2901000000000000</data>
|
|
<asString>).......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68263</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>324505678657880064</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ab7af7b8-34b2-47a2-bb0d-cfac2a1a824e}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming WSD to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2a01000000000000</data>
|
|
<asString>*.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68266</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>324472409841205248</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{15f2650a-c099-4d56-a815-a14736393443}</filterKey>
|
|
<displayData>
|
|
<name>Allow incoming WSD to PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2a01000000000000</data>
|
|
<asString>*.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68267</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>324472418431139840</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{69bf11f7-0703-41a2-933f-5699bf1ebbb4}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68291</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293747620052992</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{436b36f0-9320-423f-a04f-1a9ca00007fb}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68292</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{00117075-341a-482a-acc5-e8b238826759}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68293</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c5399251-8bef-439b-8544-8f21ffa7ba41}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68294</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293748022706176</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{82915472-9da4-48af-b908-8c7a02f6ddaf}</filterKey>
|
|
<displayData>
|
|
<name>Microsoft Store</name>
|
|
<description>Microsoft Store</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>2d01000000000000</data>
|
|
<asString>-.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>9</uint8>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-21-3172917561-344687468-1323853919-1001)(A;;CCRC;;;AC)(A;;CCRC;;;S-1-15-3-1)(A;;CCRC;;;S-1-15-3-2)(A;;CCRC;;;S-1-15-3-3)(A;;CCRC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68295</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>10376293756612640768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Receive/Accept v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="35">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_NAP_CONTEXT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>47</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e012f}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD</applicableLayer>
|
|
<calloutId>279</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<displayData>
|
|
<name>ALE Connect v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="37">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_EFFECTIVE_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>48</layerId>
|
|
</layer>
|
|
<callouts numItems="8">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_ALE_CONNECT_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec ALE Connect v4 Layer Callout</name>
|
|
<description>Applies IPsec policy modifiers to client applications.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
|
|
<calloutId>15</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Chimney Offload ALE Connect v4 Layer Callout</name>
|
|
<description>Enables or disables TCP Chimney Offload for each outgoing connection.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
|
|
<calloutId>19</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Set Option ALE Connect v4 Layer Callout</name>
|
|
<description>Sets classify options on outbound flows.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
|
|
<calloutId>23</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Templates ALE Connect v4 Layer Callout</name>
|
|
<description>Applies TCP Template for each outgoing connection.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
|
|
<calloutId>33</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Reserved callout</name>
|
|
<description>WFP Built-in Reserved callout</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
|
|
<calloutId>37</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_CONNECT_LAYER_V4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Policy Silent Mode ALE Connect v4 Layer Callout</name>
|
|
<description>Audit and log policy for outgoing connection.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
|
|
<calloutId>41</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_BUILT_IN_RESERVED_3</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Accept Redirect Proxy Tag ALE Connect v4 Layer Callout</name>
|
|
<description>Tags the outgoing connection from an accept redirected proxy app to prevent infinite redirection.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
|
|
<calloutId>47</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0230}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Allows secondary connections.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4</applicableLayer>
|
|
<calloutId>282</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="58">
|
|
<item>
|
|
<filterKey>{b6b2ca61-fb98-4422-adc2-e7cf56b3680c}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66222</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{082edf36-12d7-4698-858a-cf274b78d09a}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Loopback Exception</name>
|
|
<description>This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66601</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{304a339a-845d-47b1-9ad9-df3b55c31f26}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter allows outbound AppContainer loopback traffic</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67196</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a167c347-5706-417d-ab3f-dc24cdd9c69b}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter blocks loopback traffic to port 137</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>137</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67198</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6b9edc4a-2d53-465e-8c54-13b65024e3b6}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter blocks AppContainer loopback traffic</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551614</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67202</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551614</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0a023b5d-ef1a-45a7-9cde-efcb260348a6}</filterKey>
|
|
<displayData>
|
|
<name>Default Outbound</name>
|
|
<description>This is the default outbound filter which blocks or permits traffic based on user configured default settings</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67644</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854777848</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3bcbc8e4-3be2-43d5-8c7e-765d0de1b129}</filterKey>
|
|
<displayData>
|
|
<name>Default Outbound</name>
|
|
<description>This is the default outbound filter which blocks or permits traffic based on user configured default settings</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67648</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540928</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f7a47614-e0ec-4d6a-9cf2-99b8f993d1b7}</filterKey>
|
|
<displayData>
|
|
<name>UWP Default Outbound Block Rule</name>
|
|
<description>This is the UWP Default Outbound Block filter. This filter blocks any outbound packets from UWP apps that do not have the correct capability tokens for the resource they are trying to reach.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>9a00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{11ec8831-cda4-4bab-aa69-cb45e32f4ea9}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67659</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{81fe2467-61a3-46dc-8c59-a6a3277920ff}</filterKey>
|
|
<displayData>
|
|
<name>AxInstSV TCP outbound allow</name>
|
|
<description>Allow only outbound TCP traffic from AxInstSV</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67876</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8b7fd125-5491-4c7a-96cb-10aacbccc7d9}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5040</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5040</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67880</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1ce149fd-f072-4c78-998c-aa9be7b13469}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from any port to CDPSvc port 5050</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5050</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67882</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{71a8a4a8-65c6-4a5b-9d97-f15febdc067a}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from CDPSvc port 5050</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5050</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67884</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1055737321095168</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2c84d584-7bc5-40db-b6c8-b28d4e40a483}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from CDPSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67886</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{672ccb84-0882-4542-8404-7650c867a918}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5160</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67890</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{185c4b7a-6d3f-46ab-9a41-146c6ec220be}</filterKey>
|
|
<displayData>
|
|
<name>Block outbound traffic from deviceenroller.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>cc00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\deviceenroller.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{4dd4109f-8980-4e66-b307-887227d761a4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67898</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b832287d-98a4-4509-9edf-e796cf1a363f}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from deviceenroller.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>cd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\deviceenroller.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67900</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985299857440768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7d008627-122e-4757-94f3-40fd1e6a32ab}</filterKey>
|
|
<displayData>
|
|
<name>Block outbound traffic from omadmclient.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ce00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\omadmclient.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{f876928c-1566-4b9a-a110-57d531115565}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67902</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4d0e90b1-9d99-4847-afad-63b5336d414a}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from omadmclient.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>cf00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\omadmclient.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67904</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985299857440768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{af29eee0-e0d3-4834-8d51-668e799215c9}</filterKey>
|
|
<displayData>
|
|
<name>Block outbound traffic from dmcertinst.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\dmcertinst.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{3742db91-517a-4f69-b378-08c5c09364b3}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67908</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4fdcd4c6-c326-4b60-b320-84fc25c10cec}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from dmcertinst.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d200000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\dmcertinst.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67910</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985299857440768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a93ec3cd-e423-4bd5-a38d-3593f40c2fe6}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from DMEnrollment</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67912</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c830f042-5e91-4521-9d1a-c08aeac73a48}</filterKey>
|
|
<displayData>
|
|
<name>DhcpFirewallPolicy</name>
|
|
<description>DhcpFirewallPolicy</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>68</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>67</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67914</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1057661466443776</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{bd69a0ac-3eec-43c2-8e77-57159930f77f}</filterKey>
|
|
<displayData>
|
|
<name>DhcpFirewallPolicy</name>
|
|
<description>DhcpFirewallPolicy</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>546</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>547</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67920</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1057661466443776</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e9f93da5-9659-46c5-9525-93d80021b23f}</filterKey>
|
|
<displayData>
|
|
<name>Device Metadata Retrieval</name>
|
|
<description>Allow dmrc communication with WMIS</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-286057374-2594772386-1471686342-3682429118-820474675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>80</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67922</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{180cd47b-5d74-4505-a1ff-cd84de1d2af5}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from fdphost port 3702</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>db00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67928</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8e168718-b7a5-4ae5-80ee-67e629a24d19}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from fdphost port 1900</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>dd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1900</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67932</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b0589e60-9f9a-43aa-9d6b-5f8d52dafd90}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from fdphost</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>de00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67934</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{04419b91-af39-4843-9b6a-7676f52111a6}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic to LMHosts port 53</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>df00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>53</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67936</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{5ba31685-5a93-4ec1-8559-7e4dc41cd4a0}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic to LMHosts port 53</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>53</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67938</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{03d2ca8b-de9c-4271-9379-2c7e01346d1d}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from AJRouter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67944</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{beec7dba-4e91-4b23-a7b7-4b946d7b0a03}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from AJRouter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67946</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0f4eb248-1eb1-44e8-af26-3139fc422409}</filterKey>
|
|
<displayData>
|
|
<name>Allow Grouping to send to port 3587</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3587</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67950</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8b18ea82-9285-46f1-9d5c-8825be7defbb}</filterKey>
|
|
<displayData>
|
|
<name>Allow PNRP to send to port 3540</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3540</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1024</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>65535</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67954</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1056012199002112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{48f7051b-b0ca-4b0d-b025-7331aa9463cc}</filterKey>
|
|
<displayData>
|
|
<name>IPsec Policy Agent service hardening - LDAP/TCP</name>
|
|
<description>Allow IPsec Policy Agent outbound LDAP/TCP traffic to Active Directory</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>389</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67956</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2b4cfcf1-3509-4705-ab10-1385dd1b35e3}</filterKey>
|
|
<displayData>
|
|
<name>IPsec Policy Agent service hardening - LDAP/UDP</name>
|
|
<description>Allow IPsec Policy Agent outbound LDAP/UDP traffic to Active Directory</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ea00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>389</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67958</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{58ee92c1-2cae-43e7-ab8a-b4063a731c8a}</filterKey>
|
|
<displayData>
|
|
<name>Block all outbound traffic from SearchFilterHost</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ed00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\searchfilterhost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{03843031-9e01-449d-b94b-047c6fbe714c}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67964</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>137438953472</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{59fe49fe-991b-4b1c-bba1-70fef8bbd4c6}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound LDAP traffic from SearchIndexer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ee00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006500610072006300680069006e00640065007800650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\searchindexer.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>389</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67966</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0391cc05-7e9f-4eef-be8f-7ba037e44a34}</filterKey>
|
|
<displayData>
|
|
<name>Allow all outbound TCP and RPC from SPPEXTCOMOBJ</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f200000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\sppextcomobj.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67974</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2d002771-07b6-494c-abea-3ab1a1b89169}</filterKey>
|
|
<displayData>
|
|
<name>Allow all outbound TCP ports traffic for vmicheartbeat</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>65535</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67986</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985643454824448</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{79d5cc16-49fc-4996-b3a5-2f02a2d79e01}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from local NTP port 123 to remote NTP port 123</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>123</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>123</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67990</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>1057661466443776</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{06fc5b6e-ce4e-4355-ae4f-5b3a5c4ccf25}</filterKey>
|
|
<displayData>
|
|
<name>Allow TCP traffic from Wcmsvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>fa00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67994</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0f6315c7-96ec-4ed5-9553-6c3ba0363148}</filterKey>
|
|
<displayData>
|
|
<name>Allow NTP traffic from Wcmsvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>fb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>123</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67996</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{13f46409-d68e-488e-ad18-7f4fb2fe2b64}</filterKey>
|
|
<displayData>
|
|
<name>Allow Out TCP traffic from WinDefend</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>fc00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f0077007300200064006500660065006e006400650072005c006d0073006d00700065006e0067002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windows defender\msmpeng.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67998</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{aef21544-e454-4d2f-a571-e803b3a9e120}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from WinHttpAutoProxySvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>fd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68000</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8915b586-51f3-4e71-9282-cff4dbeca20c}</filterKey>
|
|
<displayData>
|
|
<name>Allow TCP traffic from lpasvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0001000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68010</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ee4f6b00-cba1-40d4-8d89-0310b8975f30}</filterKey>
|
|
<displayData>
|
|
<name>Allow HTTP traffic from cloudidsvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0101000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>443</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68012</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>987292722266112</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ca791cd5-85a3-4b7f-8b6b-9d9cb02ac722}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing TCP from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0401000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68022</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4c5f7c67-c7ce-4313-a45b-70f03fbad5fc}</filterKey>
|
|
<displayData>
|
|
<name>WinDefend Outbound for TCP</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0a01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310038002e0032003200300031002e00310030002d0030005c006d0073006d00700065006e0067002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\programdata\microsoft\windows defender\platform\4.18.2201.10-0\msmpeng.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68044</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>985368576917504</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d07a9c84-a50f-40c9-80f5-303ab4951d68}</filterKey>
|
|
<displayData>
|
|
<name>WSH Default Outbound Block</name>
|
|
<description>Blocks all outbound traffic for services who have been network hardened</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-2627155378-1124895651-3977206752-2157268346-3811978089)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{de04f4bd-a953-47f6-b1b6-eb6e24a546d6}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68049</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>68719476736</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{e4639f53-f9fd-4949-aec7-e3eefd4e43b4}</filterKey>
|
|
<displayData>
|
|
<name>FTP Inspection Filter</name>
|
|
<description>This filter enables inspection of FTP.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1024</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>65535</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0230}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68054</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{44a498f6-139a-41f2-8d9b-a4ec3885601a}</filterKey>
|
|
<displayData>
|
|
<name>InternetClientServer Outbound Default Rule</name>
|
|
<description>InternetClientServer Outbound Default Rule</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>1d01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>255.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68210</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>206158432248</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4c0965e1-a644-4286-b045-9dd0db4c0ac6}</filterKey>
|
|
<displayData>
|
|
<name>InternetClient Default Rule</name>
|
|
<description>InternetClient Default Rule</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>1e01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>255.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68212</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>206158432248</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c70ec623-3900-4841-b0d8-57ba37b02d03}</filterKey>
|
|
<displayData>
|
|
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-Out)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2801000000000000</data>
|
|
<asString>(.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68256</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>253259241672933376</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{825d479b-33b3-47ee-9667-cddf6646c94a}</filterKey>
|
|
<displayData>
|
|
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-Out)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2801000000000000</data>
|
|
<asString>(.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="9">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68257</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>253259276032671744</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{7f29d8b2-c34e-4676-a939-0a56f30f4fb2}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing WSD from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2b01000000000000</data>
|
|
<asString>+.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68268</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>253257317527584768</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{71d65205-3137-4c02-a833-96c6b1ee73d8}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing WSD from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2b01000000000000</data>
|
|
<asString>+.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68269</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>253257351887323136</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{427a2740-809d-4a32-8a1e-03584c5ca624}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing WSD from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2c01000000000000</data>
|
|
<asString>,.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68272</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>253188872928755712</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4d84d151-4c1c-40c9-a0e6-d2be2bdb3bf2}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing WSD from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2c01000000000000</data>
|
|
<asString>,.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>10.0.2.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>224.0.0.0</uint32>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>239.255.255.255</uint32>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68273</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>253188907288494080</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Connect v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="37">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_EFFECTIVE_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>49</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0131}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD</applicableLayer>
|
|
<calloutId>274</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<displayData>
|
|
<name>ALE Connect v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="37">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_EFFECTIVE_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>50</layerId>
|
|
</layer>
|
|
<callouts numItems="8">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_IPSEC_ALE_CONNECT_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec ALE Connect v6 Layer Callout</name>
|
|
<description>Applies IPsec policy modifiers to client applications.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
|
|
<calloutId>16</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Chimney Offload ALE Connect v6 Layer Callout</name>
|
|
<description>Enables or disables TCP Chimney Offload for each outgoing connection.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
|
|
<calloutId>20</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Set Option ALE Connect v6 Layer Callout</name>
|
|
<description>Sets classify options on outbound flows.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
|
|
<calloutId>24</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Templates ALE Connect v6 Layer Callout</name>
|
|
<description>Applies TCP Template for each outgoing connection.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
|
|
<calloutId>34</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Reserved callout</name>
|
|
<description>WFP Built-in Reserved callout</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
|
|
<calloutId>38</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_POLICY_SILENT_MODE_AUTH_CONNECT_LAYER_V6</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Policy Silent Mode ALE Connect v6 Layer Callout</name>
|
|
<description>Audit and log policy for outgoing connection.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
|
|
<calloutId>42</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_BUILT_IN_RESERVED_4</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Accept Redirect Proxy Tag ALE Connect v6 Layer Callout</name>
|
|
<description>Tags the outgoing connection from an accept redirected proxy app to prevent infinite redirection.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
|
|
<calloutId>48</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0232}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Allows secondary connections.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6</applicableLayer>
|
|
<calloutId>283</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="82">
|
|
<item>
|
|
<filterKey>{0aa7fff8-919f-453c-928c-28a12122ba38}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66223</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{15d327cf-89c3-4032-9ded-774ae6b0b49f}</filterKey>
|
|
<displayData>
|
|
<name>Quarantine Default Inbound Loopback Exception</name>
|
|
<description>This filter allows loopback packets when the network was in quarantine state. The quarantine state was triggered by a network state change.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_PERSISTENT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>66600</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2c73ec55-e34c-4ebd-8e2e-6268206bc153}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter allows outbound AppContainer loopback traffic</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67197</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d26fbfe7-0a28-45b2-83fd-95b733e1a9fd}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter blocks loopback traffic to port 137</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>137</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67199</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c5fbb5ec-e4fc-4aac-810a-4219a166cf1c}</filterKey>
|
|
<displayData>
|
|
<name>AppContainerLoopback</name>
|
|
<description>This filter blocks AppContainer loopback traffic</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551614</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;AC)(A;;CC;;;S-1-15-3-1)(A;;CC;;;S-1-15-3-2)(A;;CC;;;S-1-15-3-3)(A;;CC;;;S-1-15-3-4214768333-1334025770-122408079-3919188833)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67203</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551614</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8c247d5b-b402-40bb-a35b-a55ec3043f1a}</filterKey>
|
|
<displayData>
|
|
<name>Default Outbound</name>
|
|
<description>This is the default outbound filter which blocks or permits traffic based on user configured default settings</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>8</uint8>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67646</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>9223372036854776824</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0c22b647-52e8-484c-aaea-f3d7f4d9dc11}</filterKey>
|
|
<displayData>
|
|
<name>Default Outbound</name>
|
|
<description>This is the default outbound filter which blocks or permits traffic based on user configured default settings</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>9500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67650</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>3458764513820540928</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{3af696f6-6a4c-47bb-b032-e6c4faf8cb88}</filterKey>
|
|
<displayData>
|
|
<name>UWP Default Outbound Block Rule</name>
|
|
<description>This is the UWP Default Outbound Block filter. This filter blocks any outbound packets from UWP apps that do not have the correct capability tokens for the resource they are trying to reach.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>9a00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{11ec8831-cda4-4bab-aa69-cb45e32f4ea9}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67660</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>68719476736</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{091b498c-ac44-4e38-8c3d-f40842f71020}</filterKey>
|
|
<displayData>
|
|
<name>AxInstSV TCP outbound allow</name>
|
|
<description>Allow only outbound TCP traffic from AxInstSV</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67877</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{66fc1e24-94a1-4f94-8737-a817f1f93509}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5040</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5040</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67881</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{cab91dde-a33b-4d6d-a373-6f1a085eeee2}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from any port to CDPSvc port 5050</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5050</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67883</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{12268eee-a96f-414e-ada7-93a9394ae68b}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from CDPSvc port 5050</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c500000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5050</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67885</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>123248381526016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2bea35b9-7546-4ba2-bc6d-a11e73d8837b}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from CDPSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67887</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2a9440fb-0bb0-4ff6-8154-d72d60d909a7}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from CDPSvc from any port to port 5160 (Wi-Fi Direct Transport)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>c800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>5160</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67891</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8f1aa30f-7e4d-48d2-8fdf-35af8b7e5b61}</filterKey>
|
|
<displayData>
|
|
<name>Block outbound traffic from deviceenroller.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>cc00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\deviceenroller.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{4dd4109f-8980-4e66-b307-887227d761a4}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67899</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>68719476736</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6ce0ad1a-cbde-40c6-b942-6c6e066d8c2a}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from deviceenroller.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>cd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006500760069006300650065006e0072006f006c006c00650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\deviceenroller.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67901</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105621835743232</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f30f70ce-47ff-49f7-ba7c-145a3a153449}</filterKey>
|
|
<displayData>
|
|
<name>Block outbound traffic from omadmclient.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ce00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\omadmclient.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{f876928c-1566-4b9a-a110-57d531115565}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67903</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>68719476736</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d44825a1-c9fc-485f-98ce-3dd7eecc4876}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from omadmclient.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>cf00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c006f006d00610064006d0063006c00690065006e0074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\omadmclient.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67905</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105621835743232</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{30e3a6fe-4e5f-4560-8c1b-62c80250709a}</filterKey>
|
|
<displayData>
|
|
<name>Block outbound traffic from dmcertinst.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d100000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\dmcertinst.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{3742db91-517a-4f69-b378-08c5c09364b3}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67909</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>68719476736</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{fd5d3521-ac9a-4868-9645-f41db0a96e6a}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from dmcertinst.exe</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d200000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0064006d00630065007200740069006e00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\dmcertinst.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67911</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105621835743232</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1e6890f9-a50c-4153-a5fc-33c0ba2a1836}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from DMEnrollment</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67913</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0036b900-9ed0-4134-bb44-eea7ec2cedee}</filterKey>
|
|
<displayData>
|
|
<name>DhcpFirewallPolicy</name>
|
|
<description>DhcpFirewallPolicy</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>68</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>67</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67915</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>123660698386432</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{296e7a35-573a-40e4-b4e4-b9b262f32db0}</filterKey>
|
|
<displayData>
|
|
<name>DhcpFirewallPolicy</name>
|
|
<description>DhcpFirewallPolicy</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d700000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>546</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>547</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67921</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>123660698386432</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{166a1317-b522-45a1-80ea-9e19153e6b25}</filterKey>
|
|
<displayData>
|
|
<name>Device Metadata Retrieval</name>
|
|
<description>Allow dmrc communication with WMIS</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>d800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-286057374-2594772386-1471686342-3682429118-820474675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>80</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67923</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a777788c-4705-40a1-ab2b-5a19760caed9}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from fdphost port 3702</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>db00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67929</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f0c77ee0-11f9-4b1c-a42d-8f616ae354f3}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from fdphost port 1900</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>dd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1900</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67933</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{69327dfd-e878-4369-929c-e3b6e676fbfd}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from fdphost</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>de00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67935</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{626987bd-a33b-47b9-9615-37f568d01d82}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic to LMHosts port 53</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>df00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>53</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67937</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c29ccedf-39ff-434c-9a77-dcbf23e65d78}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic to LMHosts port 53</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e000000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>53</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67939</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c0781e20-e98e-4edd-8629-83265170d024}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from AJRouter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e300000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67945</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{19a3f689-f230-43bc-a1c6-ea367563c31f}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from AJRouter</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e400000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67947</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{eb9eb551-58b9-438d-93e3-5e9bfd3fa4a4}</filterKey>
|
|
<displayData>
|
|
<name>Allow Grouping to send to port 3587</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3587</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67951</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{72db2410-37d0-4a0c-ab90-2f27b91f8fa6}</filterKey>
|
|
<displayData>
|
|
<name>Allow PNRP to send to port 3540</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3540</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1024</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>65535</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67955</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>123385820479488</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{fc565d30-798d-41ae-9037-248e9c9ce633}</filterKey>
|
|
<displayData>
|
|
<name>IPsec Policy Agent service hardening - LDAP/TCP</name>
|
|
<description>Allow IPsec Policy Agent outbound LDAP/TCP traffic to Active Directory</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>e900000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>389</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67957</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{051461c3-1d6e-4214-9e67-820fc2e2d10a}</filterKey>
|
|
<displayData>
|
|
<name>IPsec Policy Agent service hardening - LDAP/UDP</name>
|
|
<description>Allow IPsec Policy Agent outbound LDAP/UDP traffic to Active Directory</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ea00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>389</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67959</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{755391ea-bc1b-4822-907e-1102749cfb38}</filterKey>
|
|
<displayData>
|
|
<name>Block all outbound traffic from SearchFilterHost</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ed00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c00730065006100720063006800660069006c0074006500720068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\searchfilterhost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{03843031-9e01-449d-b94b-047c6fbe714c}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>67965</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>68719476736</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6a06e8ac-2968-42da-8e51-0e4a0d3b92a4}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound LDAP traffic from SearchIndexer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>ee00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073006500610072006300680069006e00640065007800650072002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\searchindexer.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>389</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67967</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{25a4c983-4191-4c5a-8895-590d672049e0}</filterKey>
|
|
<displayData>
|
|
<name>Allow all outbound TCP and RPC from SPPEXTCOMOBJ</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f200000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007000700065007800740063006f006d006f0062006a002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\sppextcomobj.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67975</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4222b1e0-05d8-45ef-b1d6-eda36f16a14f}</filterKey>
|
|
<displayData>
|
|
<name>Allow all outbound TCP ports traffic for vmicheartbeat</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f600000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>65535</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67987</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105793634435072</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1b42b924-8daa-4a22-a438-4ce931610f24}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound UDP traffic from local NTP port 123 to remote NTP port 123</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>f800000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>123</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>123</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67991</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>123660698386432</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f79665c6-3633-4d7b-9c44-461d448be8be}</filterKey>
|
|
<displayData>
|
|
<name>Allow TCP traffic from Wcmsvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>fa00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67995</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{6b276741-4138-4dd3-8d90-394998728306}</filterKey>
|
|
<displayData>
|
|
<name>Allow NTP traffic from Wcmsvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>fb00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>123</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67997</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{65ad8ec4-5659-493a-998e-f37f54973c02}</filterKey>
|
|
<displayData>
|
|
<name>Allow Out TCP traffic from WinDefend</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>fc00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f0077007300200064006500660065006e006400650072005c006d0073006d00700065006e0067002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\program files\windows defender\msmpeng.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67999</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{023dae46-b7c7-40c8-90ca-45c70ba97068}</filterKey>
|
|
<displayData>
|
|
<name>Allow outbound TCP traffic from WinHttpAutoProxySvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>fd00000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68001</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{734e929d-2a7b-45e8-a576-1721a9075413}</filterKey>
|
|
<displayData>
|
|
<name>Allow TCP traffic from lpasvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0001000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68011</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0999a296-1a9e-40e5-bd28-08bf5f4fa7a6}</filterKey>
|
|
<displayData>
|
|
<name>Allow HTTP traffic from cloudidsvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0101000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>443</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68013</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>106068512342016</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{d60de164-082e-49f2-8c7f-1fc5f5749f53}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing TCP from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0401000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68023</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c0d7b9ed-5246-4d59-87fc-1d39339b02c4}</filterKey>
|
|
<displayData>
|
|
<name>WinDefend Outbound for TCP</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>0a01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="3">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00700072006f006700720061006d0064006100740061005c006d006900630072006f0073006f00660074005c00770069006e0064006f0077007300200064006500660065006e006400650072005c0070006c006100740066006f0072006d005c0034002e00310038002e0032003200300031002e00310030002d0030005c006d0073006d00700065006e0067002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\programdata\microsoft\windows defender\platform\4.18.2201.10-0\msmpeng.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68045</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>105656195481600</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{05baa320-a8d8-40e3-b310-3b7d7c115dac}</filterKey>
|
|
<displayData>
|
|
<name>WSH Default Outbound Block</name>
|
|
<description>Blocks all outbound traffic for services who have been network hardened</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>D:(A;NP;CC;;;S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775)(A;NP;CC;;;S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633)(A;NP;CC;;;S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147)(A;NP;CC;;;S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487)(A;NP;CC;;;S-1-5-80-3433512109-503559027-1389316256-1766580070-2256751264)(A;NP;CC;;;S-1-5-80-2611951811-1959136347-1062071333-3982815153-2811717512)(A;NP;CC;;;S-1-5-80-2839768381-3691089589-2614646340-3191585287-3380622033)(A;NP;CC;;;S-1-5-80-538170410-2190149038-799223143-2506663053-4165713448)(A;NP;CC;;;S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582)(A;NP;CC;;;S-1-5-80-2627155378-1124895651-3977206752-2157268346-3811978089)(A;NP;CC;;;S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328)(A;NP;CC;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;NP;CC;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)(A;NP;CC;;;S-1-5-80-364023826-931424190-487969545-1024119571-74567675)(A;NP;CC;;;S-1-5-80-2617507558-3328795327-711547822-311560295-1636921165)(A;NP;CC;;;S-1-5-80-89818136-74175777-88572358-3912780041-2421659406)(A;NP;CC;;;S-1-5-80-172094073-716411664-54255058-185476446-2329512179)(A;NP;CC;;;S-1-5-80-3532809085-2652327567-2620918877-1058261733-582902671)(A;NP;CC;;;S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052)(A;NP;CC;;;S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835)(A;NP;CC;;;S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580)(A;NP;CC;;;S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259)(A;NP;CC;;;S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051)(A;NP;CC;;;S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820)(A;NP;CC;;;S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613)(A;NP;CC;;;S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301)(A;NP;CC;;;S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853)(A;NP;CC;;;S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034)(A;NP;CC;;;S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619)(A;NP;CC;;;S-1-5-80-3895724531-1583119856-3186271294-3795977770-3211684703)(A;NP;CC;;;S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191)(A;NP;CC;;;S-1-5-80-949921180-3923668869-394927020-528789358-3592448931)(A;NP;CC;;;S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239)(A;NP;CC;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)(A;NP;CC;;;S-1-5-80-1989757894-211065159-731672622-1783776043-3948168785)(A;NP;CC;;;S-1-5-80-3074984378-4122987768-2130325677-2031866499-3405430279)(A;NP;CC;;;S-1-5-80-534935901-3437432317-481271085-1710633381-983106267)(A;NP;CC;;;S-1-5-80-1877308096-3090306141-3032871208-3115266146-1400827410)(A;NP;CC;;;S-1-5-80-3076811988-2254870394-2658297454-3934945422-2393138642)(A;NP;CC;;;S-1-5-80-3110303136-3426481729-3186938678-1087894076-2178433439)(A;NP;CC;;;S-1-5-80-3098585136-2538892366-1097114017-2832417424-2016953023)(A;NP;CC;;;S-1-5-80-235582178-102246843-358262472-4132936818-1867412993)(A;NP;CC;;;S-1-5-80-1752088424-1054500994-3489791022-3310831482-3926524968)(A;NP;CC;;;S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505)(A;NP;CC;;;S-1-5-80-4155767994-3874329934-3800885181-2130851812-726865888)(A;NP;CC;;;S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838)(A;NP;CC;;;S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)(A;NP;CC;;;S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725)(A;NP;CC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)(A;NP;CC;;;S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814)(A;NP;CC;;;S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297)(A;NP;CC;;;S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886)(A;NP;CC;;;S-1-5-80-689100834-1985168674-2379302174-2224748125-4125308070)(A;NP;CC;;;S-1-5-80-2119957892-4152124429-3625998117-4006912763-1737903618)(A;NP;CC;;;S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523)(A;NP;CC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)(A;NP;CC;;;S-1-5-80-113310567-2163499630-2787090463-221477905-209227094)(A;NP;CC;;;S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736)S:NO_ACCESS_CONTROL</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_BLOCK</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{de04f4bd-a953-47f6-b1b6-eb6e24a546d6}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68048</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>34359738368</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{892a3cae-0c40-4a8a-8aa4-cf539bbed38a}</filterKey>
|
|
<displayData>
|
|
<name>FTP Inspection Filter</name>
|
|
<description>This filter enables inspection of FTP.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>1024</uint16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>65535</uint16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_UNKNOWN</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0232}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68055</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8b1704e1-3f4f-4fe2-bc92-0b013dd74bdb}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68112</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9b3fa2c3-4e42-4c0f-8afb-e9f0d58e9261}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68113</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4bfd4120-6a07-4b97-81fa-455048c76e4a}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68114</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{fcdc301b-92d9-44bb-b257-88b581b56248}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68115</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{408fb9f7-e31d-4c1a-9056-0660f482826f}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68116</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b0b78a7e-20d4-45d6-987c-57a5783592fb}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68117</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{2f99501c-4c59-413b-b954-3ff993fdbfae}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68118</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f8157303-181c-4c8d-b79c-47bfde1aeaf0}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68119</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b17cc3b4-a615-46f3-b2c6-2687d34fab02}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68120</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9b7b4e38-e234-44d2-b571-d374e27a4e0b}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68121</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a1619fd8-02a0-47b7-b5e0-cfa96070a783}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68122</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{c08500c7-668a-4bac-945c-34b70d89be0b}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>136</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68123</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{58083807-89f3-4df3-9a42-0030b4a28be1}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68124</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{cc4f4f68-e749-4deb-9532-8eeecc65fd2e}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68125</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8c5974d0-a252-4be3-8805-88649820ec32}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68126</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{1a3d3203-0424-42d8-8027-248351309474}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68127</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{0b8840ae-0286-4003-a653-1918f0bb88e6}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68128</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{59c1253f-d019-4d86-9d10-a620dedbf830}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68129</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{75410a3a-fb4b-4c4e-a43b-65fa2f6b12b6}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68130</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8a3541a0-0456-4909-91bc-a016060fc4ba}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68131</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{bad0a5c5-8e42-4b2e-907d-43d004424df9}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68132</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{85fd608d-794c-47d5-9819-86dddddd6fb6}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>3</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68133</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f09da621-2d41-44ef-80d0-142da1df005b}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>2</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68134</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{88bbe0f8-8dfc-4699-a847-a9349a4af991}</filterKey>
|
|
<displayData>
|
|
<name>Boot Time Filter</name>
|
|
<description>This filter is in effect before the service starts.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
<item>FWPM_FILTER_FLAG_HAS_FILTER_ORIGIN</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>58</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>133</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>3</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>131</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>14</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<reserved/>
|
|
<filterId>68135</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{429c6993-632c-4633-b930-65684a5b7300}</filterKey>
|
|
<displayData>
|
|
<name>InternetClientServer Outbound Default Rule</name>
|
|
<description>InternetClientServer Outbound Default Rule</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>1d01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;S-1-15-3-2)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68211</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>103079216120</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{82e6ae67-453a-49bd-b6e2-7b46d586602a}</filterKey>
|
|
<displayData>
|
|
<name>InternetClient Default Rule</name>
|
|
<description>InternetClient Default Rule</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData>
|
|
<data>1e01000000000000</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_NOT_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SID</type>
|
|
<sid>S-1-0-0</sid>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68213</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>103079216120</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{9a8412a0-0fd5-462c-a11f-eb5ec9fc9709}</filterKey>
|
|
<displayData>
|
|
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-Out)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2801000000000000</data>
|
|
<asString>(.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68258</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>162253247820595200</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ad448bcc-9e58-4f9d-9d01-844b5628280b}</filterKey>
|
|
<displayData>
|
|
<name>Wi-Fi Direct ASP Coordination Protocol (UDP-Out)</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2801000000000000</data>
|
|
<asString>(.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="9">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>7235</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68259</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>162253265000464384</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{ca82888c-e15c-4d97-9deb-f172bcc2c55c}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing WSD from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2b01000000000000</data>
|
|
<asString>+.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68270</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>162252835503734784</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{413958f1-052c-41bb-9600-59345c58297d}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing WSD from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2b01000000000000</data>
|
|
<asString>+.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68271</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>162252852683603968</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b5b94431-92bb-4993-ae20-dca728cb6a3f}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing WSD from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2c01000000000000</data>
|
|
<asString>,.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68274</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>162235655634550784</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{f3611be4-ea21-41ad-bfbb-ff12ffc536f9}</filterKey>
|
|
<displayData>
|
|
<name>Allow outgoing WSD from PeerDistSvc</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_FILTER_FLAG_INDEXED</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData>
|
|
<data>2c01000000000000</data>
|
|
<asString>,.......</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_BYTE_BLOB_TYPE</type>
|
|
<byteBlob>
|
|
<data>5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650033005c00770069006e0064006f00770073005c00730079007300740065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
|
<asString>\device\harddiskvolume3\windows\system32\svchost.exe</asString>
|
|
</byteBlob>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_SECURITY_DESCRIPTOR_TYPE</type>
|
|
<sd>O:SYG:SYD:(A;;CCRC;;;S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329)</sd>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>fe80::ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<matchType>FWP_MATCH_RANGE</matchType>
|
|
<conditionValue>
|
|
<type>FWP_RANGE_TYPE</type>
|
|
<rangeValue>
|
|
<valueLow>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ff00::</byteArray16>
|
|
</valueLow>
|
|
<valueHigh>
|
|
<type>FWP_BYTE_ARRAY16_TYPE</type>
|
|
<byteArray16>ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</byteArray16>
|
|
</valueHigh>
|
|
</rangeValue>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>3702</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_ALL_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>4</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_PERMIT</type>
|
|
<filterType/>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68275</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>162235672814419968</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Connect v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="37">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_ARRIVAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_NEXTHOP_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REAUTHORIZE_REASON</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ORIGINAL_ICMP_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_EFFECTIVE_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>51</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0133}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD</applicableLayer>
|
|
<calloutId>275</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</layerKey>
|
|
<displayData>
|
|
<name>ALE Flow Established v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="20">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>52</layerId>
|
|
</layer>
|
|
<callouts numItems="4">
|
|
<item>
|
|
<calloutKey>{8e44982b-f477-11df-85ce-78e7d1810190}</calloutKey>
|
|
<displayData>
|
|
<name>NDU Flow Established V4 Callout</name>
|
|
<description>NDU Flow Established V4 Callout</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000360</item>
|
|
</flags>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</applicableLayer>
|
|
<calloutId>262</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0134}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</applicableLayer>
|
|
<calloutId>280</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0334}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Initiates deep protocol inspection on the flow.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</applicableLayer>
|
|
<calloutId>286</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{f762e452-8bfd-47f6-9425-368d888b01dc}</calloutKey>
|
|
<displayData>
|
|
<name>windefend_flow_established_v4</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</applicableLayer>
|
|
<calloutId>298</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="4">
|
|
<item>
|
|
<filterKey>{8e44982c-f477-11df-85ce-78e7d1810190}</filterKey>
|
|
<displayData>
|
|
<name>NDU Flow Established V4 SubLayer Filter</name>
|
|
<description>NDU Flow Established V4 SubLayer Filter</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{8e44982b-f477-11df-85ce-78e7d1810190}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>66999</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>2</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a5ce04ca-2cda-423e-8fef-52fb9e9fcf3a}</filterKey>
|
|
<displayData>
|
|
<name>FTP Inspection Filter</name>
|
|
<description>This filter enables inspection of FTP.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>21</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0334}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68056</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a70ef9b7-c790-4db0-a376-0378f9815b02}</filterKey>
|
|
<displayData>
|
|
<name>FTP Inspection Filter</name>
|
|
<description>This filter enables inspection of FTP.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>21</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0334}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68058</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{a1dd6389-d3b1-4f46-9300-611216024728}</filterKey>
|
|
<displayData>
|
|
<name>windefend_flow_established_v4</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4</layerKey>
|
|
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{f762e452-8bfd-47f6-9425-368d888b01dc}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68280</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>532575961056</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Flow Established v4 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="20">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>53</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</layerKey>
|
|
<displayData>
|
|
<name>ALE Flow Established v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="20">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>54</layerId>
|
|
</layer>
|
|
<callouts numItems="4">
|
|
<item>
|
|
<calloutKey>{8e44982d-f477-11df-85ce-78e7d1810190}</calloutKey>
|
|
<displayData>
|
|
<name>NDU Flow Established V6 Callout</name>
|
|
<description>NDU Flow Established V6 Callout</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000360</item>
|
|
</flags>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</applicableLayer>
|
|
<calloutId>263</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0136}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Performs logging.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000200</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</applicableLayer>
|
|
<calloutId>281</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0336}</calloutKey>
|
|
<displayData>
|
|
<name>Windows Firewall: callout</name>
|
|
<description>Initiates deep protocol inspection on the flow.</description>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</applicableLayer>
|
|
<calloutId>287</calloutId>
|
|
</item>
|
|
<item>
|
|
<calloutKey>{31114833-2891-4edd-a8ec-2ff8549aa491}</calloutKey>
|
|
<displayData>
|
|
<name>windefend_flow_established_v6</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</applicableLayer>
|
|
<calloutId>299</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="4">
|
|
<item>
|
|
<filterKey>{8e44982e-f477-11df-85ce-78e7d1810190}</filterKey>
|
|
<displayData>
|
|
<name>NDU Flow Established V6 SubLayer Filter</name>
|
|
<description>NDU Flow Established V6 SubLayer Filter</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="1">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<matchType>FWP_MATCH_FLAGS_NONE_SET</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{8e44982d-f477-11df-85ce-78e7d1810190}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67000</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>2</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{8076bfdc-eed9-4602-9570-29b6e402fba5}</filterKey>
|
|
<displayData>
|
|
<name>FTP Inspection Filter</name>
|
|
<description>This filter enables inspection of FTP.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>21</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0336}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68057</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{b6c1c213-7518-4af8-9bcf-eeabe82c63ac}</filterKey>
|
|
<displayData>
|
|
<name>FTP Inspection Filter</name>
|
|
<description>This filter enables inspection of FTP.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData>
|
|
<data>ffffffffffffffff</data>
|
|
<asString>........</asString>
|
|
</providerData>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<weight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</weight>
|
|
<filterCondition numItems="2">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT16</type>
|
|
<uint16>21</uint16>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{c3dbed20-0bb6-4bf3-828d-96732e1e0336}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68059</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>18446744073709551615</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
<item>
|
|
<filterKey>{4994b7fe-47d8-4ac5-8fa8-77b203c5b640}</filterKey>
|
|
<displayData>
|
|
<name>windefend_flow_established_v6</name>
|
|
<description>windefend</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6</layerKey>
|
|
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>0</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>6</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<matchType>FWP_MATCH_EQUAL</matchType>
|
|
<conditionValue>
|
|
<type>FWP_UINT8</type>
|
|
<uint8>17</uint8>
|
|
</conditionValue>
|
|
</item>
|
|
</filterCondition>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{31114833-2891-4edd-a8ec-2ff8549aa491}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>68281</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>33286004704</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD</layerKey>
|
|
<displayData>
|
|
<name>ALE Flow Established v6 Discard Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="20">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_REMOTE_MACHINE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>55</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET</layerKey>
|
|
<displayData>
|
|
<name>Inbound Ethernet Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="12">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_MAC_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ETHER_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NDIS_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>56</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET</layerKey>
|
|
<displayData>
|
|
<name>Outbound Ethernet Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="12">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_MAC_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ETHER_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NDIS_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>57</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE</layerKey>
|
|
<displayData>
|
|
<name>Inbound Native MAC Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NDIS_MEDIA_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NDIS_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>58</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE</layerKey>
|
|
<displayData>
|
|
<name>Outbound Native MAC Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NDIS_MEDIA_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_NDIS_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>59</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_NAME_RESOLUTION_CACHE_V4</layerKey>
|
|
<displayData>
|
|
<name>Name Resolution Cache v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>60</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_NAME_RESOLUTION_CACHE_V6</layerKey>
|
|
<displayData>
|
|
<name>Name Resolution Cache v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_PEER_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>61</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_RELEASE_V4</layerKey>
|
|
<displayData>
|
|
<name>ALE Resource Release v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="11">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>62</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_RESOURCE_RELEASE_V6</layerKey>
|
|
<displayData>
|
|
<name>ALE Resource Release v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="11">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>63</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4</layerKey>
|
|
<displayData>
|
|
<name>ALE Endpoint Closure v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="13">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>64</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V6</layerKey>
|
|
<displayData>
|
|
<name>ALE Endpoint Closure v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="13">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>65</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_CONNECT_REDIRECT_V4</layerKey>
|
|
<displayData>
|
|
<name>ALE Connect Redirect v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>66</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_CONNECT_REDIRECT_V6</layerKey>
|
|
<displayData>
|
|
<name>ALE Connect Redirect v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_ORIGINAL_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>67</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_BIND_REDIRECT_V4</layerKey>
|
|
<displayData>
|
|
<name>ALE Bind Redirect v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>68</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{8bc14e84-4287-4c9e-81da-532335532058}</calloutKey>
|
|
<displayData>
|
|
<name>Interface Binding Callout</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_BIND_REDIRECT_V4</applicableLayer>
|
|
<calloutId>258</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_ALE_BIND_REDIRECT_V6</layerKey>
|
|
<displayData>
|
|
<name>ALE Bind Redirect v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="10">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>69</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{8bc14e84-4287-4c9e-81da-532335532059}</calloutKey>
|
|
<displayData>
|
|
<name>Interface Binding Callout</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_ALE_BIND_REDIRECT_V6</applicableLayer>
|
|
<calloutId>259</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_STREAM_PACKET_V4</layerKey>
|
|
<displayData>
|
|
<name>Stream Packet v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="12">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>70</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_STREAM_PACKET_V6</layerKey>
|
|
<displayData>
|
|
<name>Stream Packet v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="12">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>71</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INGRESS_VSWITCH_ETHERNET</layerKey>
|
|
<displayData>
|
|
<name>Ingress vSwitch Ethernet layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ETHER_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>72</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_EGRESS_VSWITCH_ETHERNET</layerKey>
|
|
<displayData>
|
|
<name>Egress vSwitch Ethernet layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="17">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY6_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ETHER_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>73</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V4</layerKey>
|
|
<displayData>
|
|
<name>Ingress vSwitch Transport v4 layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>74</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V6</layerKey>
|
|
<displayData>
|
|
<name>Ingress vSwitch Transport v6 layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>75</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V4</layerKey>
|
|
<displayData>
|
|
<name>Egress vSwitch Transport v4 layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="17">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>76</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V6</layerKey>
|
|
<displayData>
|
|
<name>Egress vSwitch Transport v6 layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="17">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_SOURCE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_DESTINATION_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VLAN_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_NETWORK_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_SOURCE_VM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_L2_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>77</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_FAST</layerKey>
|
|
<displayData>
|
|
<name>Inbound Transport v4 Layer fast</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field/>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>78</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{8e44982f-f477-11df-85ce-78e7d1810190}</calloutKey>
|
|
<displayData>
|
|
<name>NDU Inbound Transport Callout</name>
|
|
<description>NDU Inbound Transport Callout</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000360</item>
|
|
</flags>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_FAST</applicableLayer>
|
|
<calloutId>264</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{8e449830-f477-11df-85ce-78e7d1810190}</filterKey>
|
|
<displayData>
|
|
<name>NDU Inbound Transport SubLayer Filter</name>
|
|
<description>NDU Inbound Transport SubLayer Filter</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_FAST</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{8e44982f-f477-11df-85ce-78e7d1810190}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67001</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>576460752303423487</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_FAST</layerKey>
|
|
<displayData>
|
|
<name>Outbound Transport v4 Layer fast</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field/>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>79</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{8e449833-f477-11df-85ce-78e7d1810190}</calloutKey>
|
|
<displayData>
|
|
<name>NDU Outbound Transport Callout</name>
|
|
<description>NDU Outbound Transport Callout</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000360</item>
|
|
</flags>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_FAST</applicableLayer>
|
|
<calloutId>265</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{8e449834-f477-11df-85ce-78e7d1810190}</filterKey>
|
|
<displayData>
|
|
<name>NDU Outbound Transport SubLayer Filter</name>
|
|
<description>NDU Outbound Transport SubLayer Filter</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_FAST</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{8e449833-f477-11df-85ce-78e7d1810190}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67002</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>576460752303423487</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST</layerKey>
|
|
<displayData>
|
|
<name>Inbound Native MAC Layer fast</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field/>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>80</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{8e449837-f477-11df-85ce-78e7d1810190}</calloutKey>
|
|
<displayData>
|
|
<name>NDU Inbound Mac Frame Native Callout</name>
|
|
<description>NDU Inbound Mac Frame Native Callout</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>000003E0</item>
|
|
</flags>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST</applicableLayer>
|
|
<calloutId>266</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{8e449838-f477-11df-85ce-78e7d1810190}</filterKey>
|
|
<displayData>
|
|
<name>NDU Inbound Mac Frame Native SubLayer Filter</name>
|
|
<description>NDU Inbound Mac Frame Native SubLayer Filter</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{8e449837-f477-11df-85ce-78e7d1810190}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67003</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>576460752303423487</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST</layerKey>
|
|
<displayData>
|
|
<name>Outbound Native MAC Layer fast </name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field/>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>81</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>{8e449839-f477-11df-85ce-78e7d1810190}</calloutKey>
|
|
<displayData>
|
|
<name>NDU Outbound Mac Frame Native Callout</name>
|
|
<description>NDU Outbound Mac Frame Native Callout</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>000003E0</item>
|
|
</flags>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<applicableLayer>FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST</applicableLayer>
|
|
<calloutId>267</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters numItems="1">
|
|
<item>
|
|
<filterKey>{8e44983a-f477-11df-85ce-78e7d1810190}</filterKey>
|
|
<displayData>
|
|
<name>NDU Outbound Mac Frame Native SubLayer Filter</name>
|
|
<description>NDU Outbound Mac Frame Native SubLayer Filter</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<providerData/>
|
|
<layerKey>FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST</layerKey>
|
|
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
|
|
<weight>
|
|
<type>FWP_EMPTY</type>
|
|
</weight>
|
|
<filterCondition/>
|
|
<action>
|
|
<type>FWP_ACTION_CALLOUT_INSPECTION</type>
|
|
<filterType>{8e449839-f477-11df-85ce-78e7d1810190}</filterType>
|
|
</action>
|
|
<rawContext>0</rawContext>
|
|
<reserved/>
|
|
<filterId>67004</filterId>
|
|
<effectiveWeight>
|
|
<type>FWP_UINT64</type>
|
|
<uint64>576460752303423487</uint64>
|
|
</effectiveWeight>
|
|
</item>
|
|
</filters>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_INBOUND_RESERVED2</layerKey>
|
|
<displayData>
|
|
<name>Inbound HTTP Reserved Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="16">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED0</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED1</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED2</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED3</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED4</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED5</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED6</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED7</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED8</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED9</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED10</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED11</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED12</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED13</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED14</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RESERVED15</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>82</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>{29243af8-ecaf-4436-a44e-f9fb7070aa04}</layerKey>
|
|
<displayData>
|
|
<name>ALE Accept Redirect v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="12">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>83</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_BUILT_IN_RESERVED_1</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Proxy Connection ALE Accept Redirect v4 Layer Callout</name>
|
|
<description>Redirects the inbound connection to the address in the provider context.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>{29243af8-ecaf-4436-a44e-f9fb7070aa04}</applicableLayer>
|
|
<calloutId>45</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>{c9809347-218f-4b7f-a742-b281a3f631b4}</layerKey>
|
|
<displayData>
|
|
<name>ALE Accept Redirect v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_LAYER_FLAG_KERNEL</item>
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="12">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_USER_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_ACCESS_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_PACKAGE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_SID</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>84</layerId>
|
|
</layer>
|
|
<callouts numItems="1">
|
|
<item>
|
|
<calloutKey>FWPM_CALLOUT_BUILT_IN_RESERVED_2</calloutKey>
|
|
<displayData>
|
|
<name>WFP Built-in Proxy Connection ALE Accept Redirect v6 Layer Callout</name>
|
|
<description>Redirects the inbound connection to the address in the provider context.</description>
|
|
</displayData>
|
|
<flags numItems="3">
|
|
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
|
|
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
|
|
<item>00000300</item>
|
|
</flags>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<applicableLayer>{c9809347-218f-4b7f-a742-b281a3f631b4}</applicableLayer>
|
|
<calloutId>46</calloutId>
|
|
</item>
|
|
</callouts>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IPSEC_KM_DEMUX_V4</layerKey>
|
|
<displayData>
|
|
<name>IPsec KM Demux v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
</flags>
|
|
<field numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_QM_MODE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>85</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IPSEC_KM_DEMUX_V6</layerKey>
|
|
<displayData>
|
|
<name>IPsec KM Demux v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
</flags>
|
|
<field numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_QM_MODE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>86</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IPSEC_V4</layerKey>
|
|
<displayData>
|
|
<name>IPsec v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
</flags>
|
|
<field numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>87</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IPSEC_V6</layerKey>
|
|
<displayData>
|
|
<name>IPsec v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
</flags>
|
|
<field numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>88</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IKEEXT_V4</layerKey>
|
|
<displayData>
|
|
<name>IKE v4 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>89</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_IKEEXT_V6</layerKey>
|
|
<displayData>
|
|
<name>IKE v6 Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="5">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT64</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>90</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_RPC_UM</layerKey>
|
|
<displayData>
|
|
<name>RPC UM Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="17">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REMOTE_USER_TOKEN</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_IF_UUID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_IF_VERSION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_IF_FLAG</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DCOM_APP_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IMAGE_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_AUTH_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_AUTH_LEVEL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SEC_KEY_SIZE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_V4</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_V6</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_PIPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS_V4</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS_V6</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>91</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_RPC_EPMAP</layerKey>
|
|
<displayData>
|
|
<name>RPC EPMAP Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="14">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REMOTE_USER_TOKEN</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_IF_UUID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_IF_VERSION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_AUTH_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_AUTH_LEVEL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_SEC_KEY_SIZE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_V4</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_V6</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_PIPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS_V4</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS_V6</fieldKey>
|
|
<type>FWPM_FIELD_IP_ADDRESS</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>92</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_RPC_EP_ADD</layerKey>
|
|
<displayData>
|
|
<name>RPC EP ADD Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
</flags>
|
|
<field numItems="4">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_PROCESS_WITH_RPC_IF_UUID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_PROTOCOL</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT8</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_EP_VALUE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_EP_FLAGS</fieldKey>
|
|
<type>FWPM_FIELD_FLAGS</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>93</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_RPC_PROXY_CONN</layerKey>
|
|
<displayData>
|
|
<name>RPC Proxy Connect Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="6">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CLIENT_TOKEN</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_SERVER_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_SERVER_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_PROXY_AUTH_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CLIENT_CERT_OID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>94</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_RPC_PROXY_IF</layerKey>
|
|
<displayData>
|
|
<name>RPC Proxy Interface Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="8">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CLIENT_TOKEN</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_IF_UUID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_IF_VERSION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_SERVER_NAME</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_SERVER_PORT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT16</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_RPC_PROXY_AUTH_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_CLIENT_CERT_OID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>95</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
<item>
|
|
<layer>
|
|
<layerKey>FWPM_LAYER_KM_AUTHORIZATION</layerKey>
|
|
<displayData>
|
|
<name>Keying Module Authorization Layer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="2">
|
|
<item>FWPM_LAYER_FLAG_BUILTIN</item>
|
|
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
|
|
</flags>
|
|
<field numItems="7">
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_REMOTE_ID</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_TOKEN_INFORMATION_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_AUTHENTICATION_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_KM_TYPE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_KM_MODE</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_IPSEC_POLICY_KEY</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
|
|
</item>
|
|
<item>
|
|
<fieldKey>FWPM_CONDITION_KM_AUTH_NAP_CONTEXT</fieldKey>
|
|
<type>FWPM_FIELD_RAW_DATA</type>
|
|
<dataType>FWP_UINT32</dataType>
|
|
</item>
|
|
</field>
|
|
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
|
|
<layerId>96</layerId>
|
|
</layer>
|
|
<callouts/>
|
|
<filters/>
|
|
</item>
|
|
</layers>
|
|
<providers numItems="13">
|
|
<item>
|
|
<providerKey>FWPM_PROVIDER_IKEEXT</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows WFP Built-in IKEEXT provider used to identify filters added by IKE/AuthIP.</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_PROVIDER_FLAG_DISABLED</item>
|
|
</flags>
|
|
<providerData/>
|
|
<serviceName>IKEEXT</serviceName>
|
|
</item>
|
|
<item>
|
|
<providerKey>FWPM_PROVIDER_TCP_CHIMNEY_OFFLOAD</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows WFP Built-in TCP Chimney Offload provider used to identify filters added by TCP Chimney Offload.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName/>
|
|
</item>
|
|
<item>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<displayData>
|
|
<name>@bfe.dll,-1217</name>
|
|
<description>Microsoft Windows WFP Built-in MPSSVC App Isolation provider.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName>mpssvc</serviceName>
|
|
</item>
|
|
<item>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows WFP Built-in MPSSVC Windows Service Hardening and Quarantine provider.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName>mpssvc</serviceName>
|
|
</item>
|
|
<item>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_EDP</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows WFP Built-in MPSSVC Enterprise Data Protection provider.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName>mpssvc</serviceName>
|
|
</item>
|
|
<item>
|
|
<providerKey>{c698301d-9129-450c-937c-f4b834bfb374}</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows edge traversal socket option authorization provider</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName/>
|
|
</item>
|
|
<item>
|
|
<providerKey>{893a4f22-9bba-49b7-8c66-3d40929c8fd5}</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows Teredo firewall provider</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName/>
|
|
</item>
|
|
<item>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows WFP Built-in MPSSVC Windows Firewall provider.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName>mpssvc</serviceName>
|
|
</item>
|
|
<item>
|
|
<providerKey>FWPM_PROVIDER_IPSEC_DOSP_CONFIG</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows WFP Built-in IPsec DoS Protection configuration provider used to identify filters added by IPsec Denial of Service Protection.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName/>
|
|
</item>
|
|
<item>
|
|
<providerKey>FWPM_PROVIDER_TCP_TEMPLATES</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows WFP Built-in TCP Templates provider used to identify filters added by TCP Template based configuration.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName/>
|
|
</item>
|
|
<item>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_TENANT_RESTRICTIONS</providerKey>
|
|
<displayData>
|
|
<name>WFP Built-in MPSSVC Tenant Restrictions Sublayer</name>
|
|
<description>Microsoft Windows WFP Built-in MPSSVC Tenant Restrictions provider.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName>mpssvc</serviceName>
|
|
</item>
|
|
<item>
|
|
<providerKey>{1bebc969-61a5-4732-a177-847a0817862a}</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Microsoft Windows Defender Firewall IPsec Provider</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_PROVIDER_FLAG_PERSISTENT</item>
|
|
</flags>
|
|
<providerData/>
|
|
<serviceName>MPSSVC</serviceName>
|
|
</item>
|
|
<item>
|
|
<providerKey>{8e44982a-f477-11df-85ce-78e7d1810190}</providerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description>Windows Network Data Usage (NDU) Provider</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerData/>
|
|
<serviceName>NDU</serviceName>
|
|
</item>
|
|
</providers>
|
|
<providerContexts numItems="329">
|
|
<item>
|
|
<providerContextKey>FWPM_PROVIDER_CONTEXT_SECURE_SOCKET_AUTHIP</providerContextKey>
|
|
<displayData>
|
|
<name>WFP Built-in Default Secure Socket AuthIP Policy Provider Context</name>
|
|
<description>Authenticated Internet Protocol (AuthIP) main mode default policy for secure sockets.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<type>FWPM_IPSEC_AUTHIP_MM_CONTEXT</type>
|
|
<authIpMmPolicy>
|
|
<softExpirationTime>0</softExpirationTime>
|
|
<authenticationMethods numItems="1">
|
|
<item>
|
|
<authenticationMethodType>IKEEXT_ANONYMOUS</authenticationMethodType>
|
|
</item>
|
|
</authenticationMethods>
|
|
<initiatorImpersonationType>IKEEXT_IMPERSONATION_NONE</initiatorImpersonationType>
|
|
<ikeProposals numItems="2">
|
|
<item>
|
|
<cipherAlgorithm>
|
|
<algoIdentifier>IKEEXT_CIPHER_AES_128</algoIdentifier>
|
|
<keyLen>0</keyLen>
|
|
<rounds>0</rounds>
|
|
</cipherAlgorithm>
|
|
<integrityAlgorithm>
|
|
<algoIdentifier>IKEEXT_INTEGRITY_SHA1</algoIdentifier>
|
|
</integrityAlgorithm>
|
|
<maxLifetimeSeconds>7200</maxLifetimeSeconds>
|
|
<dhGroup>IKEEXT_DH_ECP_256</dhGroup>
|
|
<quickModeLimit>0</quickModeLimit>
|
|
</item>
|
|
<item>
|
|
<cipherAlgorithm>
|
|
<algoIdentifier>IKEEXT_CIPHER_3DES</algoIdentifier>
|
|
<keyLen>0</keyLen>
|
|
<rounds>0</rounds>
|
|
</cipherAlgorithm>
|
|
<integrityAlgorithm>
|
|
<algoIdentifier>IKEEXT_INTEGRITY_SHA1</algoIdentifier>
|
|
</integrityAlgorithm>
|
|
<maxLifetimeSeconds>7200</maxLifetimeSeconds>
|
|
<dhGroup>IKEEXT_DH_GROUP_2</dhGroup>
|
|
<quickModeLimit>0</quickModeLimit>
|
|
</item>
|
|
</ikeProposals>
|
|
<flags/>
|
|
<maxDynamicFilters>0</maxDynamicFilters>
|
|
<retransmitDurationSecs>0</retransmitDurationSecs>
|
|
</authIpMmPolicy>
|
|
<providerContextId>9223372036854775808</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>FWPM_PROVIDER_CONTEXT_SECURE_SOCKET_IPSEC</providerContextKey>
|
|
<displayData>
|
|
<name>WFP Built-in Default Secure Socket IPsec Policy Provider Context</name>
|
|
<description>Internet Protocol Security (IPsec) quick mode default policy for secure sockets.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<type>FWPM_IPSEC_AUTHIP_QM_TRANSPORT_CONTEXT</type>
|
|
<authipQmTransportPolicy>
|
|
<ipsecProposals numItems="4">
|
|
<item>
|
|
<lifetime>
|
|
<lifetimeSeconds>3600</lifetimeSeconds>
|
|
<lifetimeKilobytes>56320</lifetimeKilobytes>
|
|
<lifetimePackets>2147483647</lifetimePackets>
|
|
</lifetime>
|
|
<saTransforms numItems="1">
|
|
<item>
|
|
<ipsecTransformType>IPSEC_TRANSFORM_ESP_AUTH</ipsecTransformType>
|
|
<espAuthTransform>
|
|
<authTransformId>
|
|
<authType>IPSEC_AUTH_SHA_1</authType>
|
|
<authConfig>IPSEC_AUTH_CONFIG_HMAC_SHA_1_96</authConfig>
|
|
</authTransformId>
|
|
<cryptoModuleId/>
|
|
</espAuthTransform>
|
|
</item>
|
|
</saTransforms>
|
|
<pfsGroup>IPSEC_PFS_NONE</pfsGroup>
|
|
</item>
|
|
<item>
|
|
<lifetime>
|
|
<lifetimeSeconds>3600</lifetimeSeconds>
|
|
<lifetimeKilobytes>56320</lifetimeKilobytes>
|
|
<lifetimePackets>2147483647</lifetimePackets>
|
|
</lifetime>
|
|
<saTransforms numItems="1">
|
|
<item>
|
|
<ipsecTransformType>IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER</ipsecTransformType>
|
|
<espAuthAndCipherTransform>
|
|
<authTransform>
|
|
<authTransformId>
|
|
<authType>IPSEC_AUTH_SHA_1</authType>
|
|
<authConfig>IPSEC_AUTH_CONFIG_HMAC_SHA_1_96</authConfig>
|
|
</authTransformId>
|
|
<cryptoModuleId/>
|
|
</authTransform>
|
|
<cipherTransform>
|
|
<cipherTransformId>
|
|
<cipherType>IPSEC_CIPHER_TYPE_AES_128</cipherType>
|
|
<cipherConfig>IPSEC_CIPHER_CONFIG_CBC_AES_128</cipherConfig>
|
|
</cipherTransformId>
|
|
<cryptoModuleId/>
|
|
</cipherTransform>
|
|
</espAuthAndCipherTransform>
|
|
</item>
|
|
</saTransforms>
|
|
<pfsGroup>IPSEC_PFS_NONE</pfsGroup>
|
|
</item>
|
|
<item>
|
|
<lifetime>
|
|
<lifetimeSeconds>3600</lifetimeSeconds>
|
|
<lifetimeKilobytes>56320</lifetimeKilobytes>
|
|
<lifetimePackets>2147483647</lifetimePackets>
|
|
</lifetime>
|
|
<saTransforms numItems="1">
|
|
<item>
|
|
<ipsecTransformType>IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER</ipsecTransformType>
|
|
<espAuthAndCipherTransform>
|
|
<authTransform>
|
|
<authTransformId>
|
|
<authType>IPSEC_AUTH_SHA_1</authType>
|
|
<authConfig>IPSEC_AUTH_CONFIG_HMAC_SHA_1_96</authConfig>
|
|
</authTransformId>
|
|
<cryptoModuleId/>
|
|
</authTransform>
|
|
<cipherTransform>
|
|
<cipherTransformId>
|
|
<cipherType>IPSEC_CIPHER_TYPE_3DES</cipherType>
|
|
<cipherConfig>IPSEC_CIPHER_CONFIG_CBC_3DES</cipherConfig>
|
|
</cipherTransformId>
|
|
<cryptoModuleId/>
|
|
</cipherTransform>
|
|
</espAuthAndCipherTransform>
|
|
</item>
|
|
</saTransforms>
|
|
<pfsGroup>IPSEC_PFS_NONE</pfsGroup>
|
|
</item>
|
|
<item>
|
|
<lifetime>
|
|
<lifetimeSeconds>3600</lifetimeSeconds>
|
|
<lifetimeKilobytes>56320</lifetimeKilobytes>
|
|
<lifetimePackets>2147483647</lifetimePackets>
|
|
</lifetime>
|
|
<saTransforms numItems="1">
|
|
<item>
|
|
<ipsecTransformType>IPSEC_TRANSFORM_AH</ipsecTransformType>
|
|
<ahTransform>
|
|
<authTransformId>
|
|
<authType>IPSEC_AUTH_SHA_1</authType>
|
|
<authConfig>IPSEC_AUTH_CONFIG_HMAC_SHA_1_96</authConfig>
|
|
</authTransformId>
|
|
<cryptoModuleId/>
|
|
</ahTransform>
|
|
</item>
|
|
</saTransforms>
|
|
<pfsGroup>IPSEC_PFS_NONE</pfsGroup>
|
|
</item>
|
|
</ipsecProposals>
|
|
<flags numItems="1">
|
|
<item>IPSEC_POLICY_FLAG_ND_BOUNDARY</item>
|
|
</flags>
|
|
<ndAllowClearTimeoutSeconds>10</ndAllowClearTimeoutSeconds>
|
|
<saIdleTimeout>
|
|
<idleTimeoutSeconds>300</idleTimeoutSeconds>
|
|
<idleTimeoutSecondsFailOver>60</idleTimeoutSecondsFailOver>
|
|
</saIdleTimeout>
|
|
<emPolicy>
|
|
<authenticationMethods numItems="2">
|
|
<item>
|
|
<authenticationMethodType>IKEEXT_KERBEROS</authenticationMethodType>
|
|
<kerberosAuthentication>
|
|
<flags/>
|
|
<proxyServer/>
|
|
</kerberosAuthentication>
|
|
</item>
|
|
<item>
|
|
<authenticationMethodType>IKEEXT_SSL</authenticationMethodType>
|
|
<sslAuthentication>
|
|
<inboundConfigType>IKEEXT_CERT_CONFIG_TRUSTED_ROOT_STORE</inboundConfigType>
|
|
<inboundTrustedRootStoreCriteria numItems="1">
|
|
<item>
|
|
<certData/>
|
|
<certHash/>
|
|
<eku>
|
|
<numEku>1</numEku>
|
|
<eku numItems="1">
|
|
<item>1.3.6.1.5.5.7.3.2</item>
|
|
</eku>
|
|
</eku>
|
|
<name/>
|
|
<flags/>
|
|
</item>
|
|
</inboundTrustedRootStoreCriteria>
|
|
<outboundConfigType>IKEEXT_CERT_CONFIG_TRUSTED_ROOT_STORE</outboundConfigType>
|
|
<outboundTrustedRootStoreCriteria numItems="4">
|
|
<item>
|
|
<certData/>
|
|
<certHash/>
|
|
<eku>
|
|
<numEku>2</numEku>
|
|
<eku numItems="2">
|
|
<item>1.3.6.1.5.5.7.3.2</item>
|
|
<item>1.3.6.1.5.5.8.2.2</item>
|
|
</eku>
|
|
</eku>
|
|
<name/>
|
|
<flags/>
|
|
</item>
|
|
<item>
|
|
<certData/>
|
|
<certHash/>
|
|
<eku>
|
|
<numEku>1</numEku>
|
|
<eku numItems="1">
|
|
<item>1.3.6.1.5.5.7.3.2</item>
|
|
</eku>
|
|
</eku>
|
|
<name/>
|
|
<flags/>
|
|
</item>
|
|
<item>
|
|
<certData/>
|
|
<certHash/>
|
|
<eku>
|
|
<numEku>1</numEku>
|
|
<eku numItems="1">
|
|
<item>1.3.6.1.5.5.8.2.2</item>
|
|
</eku>
|
|
</eku>
|
|
<name/>
|
|
<flags/>
|
|
</item>
|
|
<item>
|
|
<certData/>
|
|
<certHash/>
|
|
<eku/>
|
|
<name/>
|
|
<flags/>
|
|
</item>
|
|
</outboundTrustedRootStoreCriteria>
|
|
<flags/>
|
|
<localCertLocationUrl/>
|
|
</sslAuthentication>
|
|
</item>
|
|
</authenticationMethods>
|
|
<initiatorImpersonationType>IKEEXT_IMPERSONATION_SOCKET_PRINCIPAL</initiatorImpersonationType>
|
|
</emPolicy>
|
|
</authipQmTransportPolicy>
|
|
<providerContextId>9223372036854775809</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{30433c31-b05f-421f-8fde-018ea4c68af4}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_PROVIDER_CONTEXT_FLAG_PERSISTENT</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>510075006100720061006e00740069006e0065002000440065006600610075006c0074000000</data>
|
|
<asString>Q.u.a.r.a.n.t.i.n.e. .D.e.f.a.u.l.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854775810</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{93132c36-6e06-4e6f-a10b-218787cd49cf}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_PROVIDER_CONTEXT_FLAG_PERSISTENT</item>
|
|
</flags>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>42006f006f007400740069006d0065002000440065006600610075006c0074000000</data>
|
|
<asString>B.o.o.t.t.i.m.e. .D.e.f.a.u.l.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854775811</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{252fe349-15c1-48d5-82a6-e62a2e483dcf}</providerContextKey>
|
|
<displayData>
|
|
<name>State Management Provider Context</name>
|
|
<description>Contains State Management Options</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_CLASSIFY_OPTIONS_CONTEXT</type>
|
|
<classifyOptions>
|
|
<options numItems="1">
|
|
<item>
|
|
<type>FWP_CLASSIFY_OPTION_LOOSE_SOURCE_MAPPING</type>
|
|
<value>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</value>
|
|
</item>
|
|
</options>
|
|
</classifyOptions>
|
|
<providerContextId>9223372036854775812</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2ea412db-5c9d-4bbd-9af2-4914d2dbfe17}</providerContextKey>
|
|
<displayData>
|
|
<name>State Management Provider Context</name>
|
|
<description>Contains State Management Options</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_CLASSIFY_OPTIONS_CONTEXT</type>
|
|
<classifyOptions>
|
|
<options numItems="1">
|
|
<item>
|
|
<type>FWP_CLASSIFY_OPTION_LOCAL_ONLY_MAPPING</type>
|
|
<value>
|
|
<type>FWP_UINT32</type>
|
|
<uint32>1</uint32>
|
|
</value>
|
|
</item>
|
|
</options>
|
|
</classifyOptions>
|
|
<providerContextId>9223372036854775813</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{9889f02d-6a85-49b4-8928-884e5ab5ee59}</providerContextKey>
|
|
<displayData>
|
|
<name>Policy Silent Mode Provider Context</name>
|
|
<description>The policy is inspected only but not enforced</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50006f006c00690063007900530069006c0065006e0074004d006f0064006500500072006f00760069006400650072000000</data>
|
|
<asString>P.o.l.i.c.y.S.i.l.e.n.t.M.o.d.e.P.r.o.v.i.d.e.r...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854775814</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{de04f4bd-a953-47f6-b1b6-eb6e24a546d6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5700530048002000440065006600610075006c0074000000</data>
|
|
<asString>W.S.H. .D.e.f.a.u.l.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854775815</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{feb49053-a00e-42a7-ab12-6f0b07ae1b2b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>51007500650072007900200055007300650072002000440065006600610075006c0074000000</data>
|
|
<asString>Q.u.e.r.y. .U.s.e.r. .D.e.f.a.u.l.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854775816</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{7f0fdfe9-b5aa-4df8-98c2-8bb515bbc12a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>41007000700043006f006e007400610069006e006500720020004c006f006f0070006200610063006b000000</data>
|
|
<asString>A.p.p.C.o.n.t.a.i.n.e.r. .L.o.o.p.b.a.c.k...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854775817</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{999ba50e-b870-4b5c-84e6-33a0e61cc8d1}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53007400650061006c00740068000000</data>
|
|
<asString>S.t.e.a.l.t.h...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854775818</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{20f3bb11-bbf6-4e60-aeb3-e651c675d642}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006800690065006c0064006500640020004d00610069006e002000520075006c0065000000</data>
|
|
<asString>S.h.i.e.l.d.e.d. .M.a.i.n. .R.u.l.e...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776151</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{28127d58-a9af-43ee-bfe2-a06cb632fa4e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>440065006600610075006c007400200049006e0062006f0075006e0064000000</data>
|
|
<asString>D.e.f.a.u.l.t. .I.n.b.o.u.n.d...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776154</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{df7bad3c-1c14-4ad9-ab82-5eb01bc9d76b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006800690065006c0064006500640020004d00610069006e002000520075006c0065000000</data>
|
|
<asString>S.h.i.e.l.d.e.d. .M.a.i.n. .R.u.l.e...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776157</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{396a665b-ae9f-4c00-a33d-098abf605990}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>440065006600610075006c007400200049006e0062006f0075006e0064000000</data>
|
|
<asString>D.e.f.a.u.l.t. .I.n.b.o.u.n.d...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776160</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{7a06a358-d5e2-4304-8970-c724ca7c9674}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006800690065006c0064006500640020004d00610069006e002000520075006c0065000000</data>
|
|
<asString>S.h.i.e.l.d.e.d. .M.a.i.n. .R.u.l.e...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776163</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{abf0b72d-a22e-427e-9139-ebca0193e5d9}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>440065006600610075006c007400200049006e0062006f0075006e0064000000</data>
|
|
<asString>D.e.f.a.u.l.t. .I.n.b.o.u.n.d...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776166</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{b36473ef-bf42-49b9-ac24-adba245e825c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5500570050002000440065006600610075006c007400200049006e0062006f0075006e006400200042006c006f0063006b002000520075006c0065000000</data>
|
|
<asString>U.W.P. .D.e.f.a.u.l.t. .I.n.b.o.u.n.d. .B.l.o.c.k. .R.u.l.e...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776169</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{11ec8831-cda4-4bab-aa69-cb45e32f4ea9}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5500570050002000440065006600610075006c00740020004f007500740062006f0075006e006400200042006c006f0063006b002000520075006c0065000000</data>
|
|
<asString>U.W.P. .D.e.f.a.u.l.t. .O.u.t.b.o.u.n.d. .B.l.o.c.k. .R.u.l.e...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776170</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{13fd7ae8-4dad-4362-9178-9991d6ac4670}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>41007500640069006f007300720076002d0031000000</data>
|
|
<asString>A.u.d.i.o.s.r.v.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776171</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{74eff966-472f-46ce-9391-ad9e1303f145}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>41007500640069006f007300720076002d0032000000</data>
|
|
<asString>A.u.d.i.o.s.r.v.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776172</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ac7ae3b6-0cf9-4ae4-9212-6c452f977570}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4100560045006e00640070006f0069006e0074004200750069006c006400650072002d0031000000</data>
|
|
<asString>A.V.E.n.d.p.o.i.n.t.B.u.i.l.d.e.r.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776173</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2153ec13-392d-4ffd-aedb-b4818c4dc9f7}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4100560045006e00640070006f0069006e0074004200750069006c006400650072002d0032000000</data>
|
|
<asString>A.V.E.n.d.p.o.i.n.t.B.u.i.l.d.e.r.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776174</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a16428ab-a823-4c1e-aee4-9bce9dd30989}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4100780049006e0073007400530056002d0031000000</data>
|
|
<asString>A.x.I.n.s.t.S.V.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776175</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3cec65bf-a4e1-4376-b287-0691e08a6f63}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4100780049006e0073007400530056002d0033000000</data>
|
|
<asString>A.x.I.n.s.t.S.V.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776176</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{9066c4f6-66a6-41fc-a268-07d1b287af42}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4200460045002d0031000000</data>
|
|
<asString>B.F.E.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776177</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{dbc25b5e-745f-46f2-800b-2178e7367202}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4200460045002d0032000000</data>
|
|
<asString>B.F.E.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776178</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{074c3ea9-af96-4a28-a6c6-db9b0335adb0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4300440050005300760063002d0032000000</data>
|
|
<asString>C.D.P.S.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776179</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e26c5b51-f344-4e59-b535-2ce78d16974c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4300440050005300760063002d0036000000</data>
|
|
<asString>C.D.P.S.v.c.-.6...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776180</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{8966736d-4524-4694-9e2e-ee9f1387e011}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00330032002d0031000000</data>
|
|
<asString>c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.3.2.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776181</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{bd49f24b-1801-46be-969c-e0cf5afd621a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00330032002d0032000000</data>
|
|
<asString>c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.3.2.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776182</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{cc755386-b9e1-4342-a317-790c4f0a9534}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00360034002d0031000000</data>
|
|
<asString>c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.6.4.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776183</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{bfa85b2e-3c06-4d69-b4e1-f149cff4661e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>63006c0072005f006f007000740069006d0069007a006100740069006f006e005f00760034002e0030002e00330030003300310039005f00360034002d0032000000</data>
|
|
<asString>c.l.r._.o.p.t.i.m.i.z.a.t.i.o.n._.v.4...0...3.0.3.1.9._.6.4.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776184</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a8b55da6-3aba-41f3-b7ba-443233f64fce}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400650076006900630065004d0061006e006100670065006d0065006e0074002d0031000000</data>
|
|
<asString>D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776185</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c4e61e5c-3e66-4efb-b22b-87f8e56cf9c2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400650076006900630065004d0061006e006100670065006d0065006e0074002d00310030000000</data>
|
|
<asString>D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.1.0...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776186</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4dd4109f-8980-4e66-b307-887227d761a4}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400650076006900630065004d0061006e006100670065006d0065006e0074002d00310031000000</data>
|
|
<asString>D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.1.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776187</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f876928c-1566-4b9a-a110-57d531115565}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400650076006900630065004d0061006e006100670065006d0065006e0074002d0032000000</data>
|
|
<asString>D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776188</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{616fdcf3-1169-46b5-8224-cffc7276af2e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400650076006900630065004d0061006e006100670065006d0065006e0074002d0034000000</data>
|
|
<asString>D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.4...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776189</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3742db91-517a-4f69-b378-08c5c09364b3}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400650076006900630065004d0061006e006100670065006d0065006e0074002d0035000000</data>
|
|
<asString>D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.5...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776190</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{49208958-c95e-48da-832f-60636a24827a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400650076006900630065004d0061006e006100670065006d0065006e0074002d0037000000</data>
|
|
<asString>D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.7...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776191</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{70f84089-a6de-44ab-88ba-681a2d87204e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400650076006900630065004d0061006e006100670065006d0065006e0074002d0038000000</data>
|
|
<asString>D.e.v.i.c.e.M.a.n.a.g.e.m.e.n.t.-.8...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776192</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{acc4c150-270a-47dc-91d0-23dcf4b073f4}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>44004800430050002d0034000000</data>
|
|
<asString>D.H.C.P.-.4...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776193</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{fa7bff4f-61db-455f-8fec-220c1122cda0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>44004800430050002d0035000000</data>
|
|
<asString>D.H.C.P.-.5...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776194</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{140da811-71af-4719-aea9-3e3196bb2c73}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>44006900730070006c006100790045006e00680061006e00630065006d0065006e00740053006500720076006900630065002000440065006e007900200041006c006c00200049006e0062006f0075006e0064000000</data>
|
|
<asString>D.i.s.p.l.a.y.E.n.h.a.n.c.e.m.e.n.t.S.e.r.v.i.c.e. .D.e.n.y. .A.l.l. .I.n.b.o.u.n.d...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776195</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e8b4f949-15cf-4ef0-8c72-4b472a399374}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>44006900730070006c006100790045006e00680061006e00630065006d0065006e00740053006500720076006900630065002000440065006e007900200041006c006c0020004f007500740062006f0075006e0064000000</data>
|
|
<asString>D.i.s.p.l.a.y.E.n.h.a.n.c.e.m.e.n.t.S.e.r.v.i.c.e. .D.e.n.y. .A.l.l. .O.u.t.b.o.u.n.d...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776196</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{29442789-6efc-46ed-b261-a526c4b07a9b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>64006f00740033007300760063002d0031000000</data>
|
|
<asString>d.o.t.3.s.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776197</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{39e96b50-7896-45bf-8a32-6df85e30668a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>64006f00740033007300760063002d0032000000</data>
|
|
<asString>d.o.t.3.s.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776198</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{b9e16b36-f84a-4ada-8ad6-72303a132d9c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400500053002d0031000000</data>
|
|
<asString>D.P.S.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776199</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d7138c16-5c23-4147-8aa2-26c31ffa3282}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4400500053002d0032000000</data>
|
|
<asString>D.P.S.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776200</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{56ca2cdd-1a5b-49db-b1b1-0c7ecda76a96}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4500760065006e0074006c006f0067002d0032000000</data>
|
|
<asString>E.v.e.n.t.l.o.g.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776201</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{66d12cf5-d1c3-4fcf-beec-60486740a808}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4500760065006e0074006c006f0067002d0033000000</data>
|
|
<asString>E.v.e.n.t.l.o.g.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776202</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{766e17d2-0adf-4c0c-a05f-bd0e3a611a0d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>66006400700068006f00730074002d0031000000</data>
|
|
<asString>f.d.p.h.o.s.t.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776203</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{82c89ca7-9d25-44bf-b763-ae9a0fc19072}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>66006400700068006f00730074002d0032000000</data>
|
|
<asString>f.d.p.h.o.s.t.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776204</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d8d7429a-458d-419c-903a-72b1770c2fa5}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>660068007300760063002d0031000000</data>
|
|
<asString>f.h.s.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776205</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e4c31fb1-c4d0-4425-80cb-13aeaf564696}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>660068007300760063002d0032000000</data>
|
|
<asString>f.h.s.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776206</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4d390cf4-706e-4f3a-afc5-75de5af9327e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>48006900640053006500720076002d0031000000</data>
|
|
<asString>H.i.d.S.e.r.v.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776207</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a03a74d6-9d42-487f-9ebf-0576fb284312}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>48006900640053006500720076002d0032000000</data>
|
|
<asString>H.i.d.S.e.r.v.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776208</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{dc9f453d-1eaa-4912-8a95-ec50252e8abd}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4c004d0048006f007300740073002d0033000000</data>
|
|
<asString>L.M.H.o.s.t.s.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776209</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{7c926fc6-603b-4a56-bd0e-683fc579cb4b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4c004d0048006f007300740073002d0034000000</data>
|
|
<asString>L.M.H.o.s.t.s.-.4...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776210</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{482ea2c8-fdf2-41e7-8c58-b77891b9e26e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4d006900630072006f0073006f00660074002d00570069006e0064006f00770073002d0041006c006c004a006f0079006e002d0052006f0075007400650072002d0042006c006f0063006b002d0049006e002d0041006c006c0045006c00730065000000</data>
|
|
<asString>M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.l.l.J.o.y.n.-.R.o.u.t.e.r.-.B.l.o.c.k.-.I.n.-.A.l.l.E.l.s.e...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776211</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{b91e477a-b12b-4ffe-8036-fb467a589bb5}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4d006900630072006f0073006f00660074002d00570069006e0064006f00770073002d0041006c006c004a006f0079006e002d0052006f0075007400650072002d0042006c006f0063006b002d004f00750074002d0041006c006c0045006c00730065000000</data>
|
|
<asString>M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.l.l.J.o.y.n.-.R.o.u.t.e.r.-.B.l.o.c.k.-.O.u.t.-.A.l.l.E.l.s.e...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776212</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{84a6277c-c2cf-4550-8617-4766635b0978}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4d00500053005300560043002d0031000000</data>
|
|
<asString>M.P.S.S.V.C.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776213</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{9dc391c3-71d8-4649-b1d5-75ed10f360a9}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4d00500053005300560043002d0032000000</data>
|
|
<asString>M.P.S.S.V.C.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776214</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{0565668f-d3c2-489b-86fc-63eaa40816b7}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4e00650074006d0061006e002d0031000000</data>
|
|
<asString>N.e.t.m.a.n.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776215</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e66edf14-6359-4ebf-a197-ba3f7537af1b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>4e00650074006d0061006e002d0032000000</data>
|
|
<asString>N.e.t.m.a.n.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776216</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a8703831-1566-41ef-a65d-e1810ef57048}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5000320050002000470072006f007500700069006e006700200042006c006f0063006b00200049006e000000</data>
|
|
<asString>P.2.P. .G.r.o.u.p.i.n.g. .B.l.o.c.k. .I.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776217</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{07e62e11-172d-4a30-af90-caf4e66d513b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5000320050002000470072006f007500700069006e006700200042006c006f0063006b0020004f00750074000000</data>
|
|
<asString>P.2.P. .G.r.o.u.p.i.n.g. .B.l.o.c.k. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776218</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{1e2445fb-9e48-41aa-98ff-d540234e8a15}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50003200500020004900640065006e007400200042006c006f0063006b00200049006e000000</data>
|
|
<asString>P.2.P. .I.d.e.n.t. .B.l.o.c.k. .I.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776219</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4fbe1969-bcf9-4b68-8e7f-12bdb7f4b5c5}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50003200500020004900640065006e007400200042006c006f0063006b0020004f00750074000000</data>
|
|
<asString>P.2.P. .I.d.e.n.t. .B.l.o.c.k. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776220</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2ec90dcd-0a0b-46e8-a930-97e228065a8d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5000630061005300760063002d0031000000</data>
|
|
<asString>P.c.a.S.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776221</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{023d6954-db44-4559-875b-c888101ce60c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5000630061005300760063002d0032000000</data>
|
|
<asString>P.c.a.S.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776222</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{0f745c88-3d06-4f3f-836a-246ed1fdb397}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>500065007200660048006f00730074002d0031000000</data>
|
|
<asString>P.e.r.f.H.o.s.t.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776223</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3f019c77-26df-4344-96a3-327d030483fd}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>500065007200660048006f00730074002d0032000000</data>
|
|
<asString>P.e.r.f.H.o.s.t.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776224</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e39d0a93-3337-4e1e-b56a-d00861b1f26a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50004e0052005000200042006c006f0063006b00200049006e000000</data>
|
|
<asString>P.N.R.P. .B.l.o.c.k. .I.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776225</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c4c5bf1b-6190-4fdc-95ec-0d4ba3d09dbc}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50004e0052005000200042006c006f0063006b0020004f00750074000000</data>
|
|
<asString>P.N.R.P. .B.l.o.c.k. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776226</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d7744c01-2520-4e53-9d09-1b4c41561898}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50006e00720070004100750074006f00200042006c006f0063006b00200049006e000000</data>
|
|
<asString>P.n.r.p.A.u.t.o. .B.l.o.c.k. .I.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776227</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f293ff68-0301-4ecb-9c6f-b0b73b0c0f99}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50006e00720070004100750074006f00200042006c006f0063006b0020004f00750074000000</data>
|
|
<asString>P.n.r.p.A.u.t.o. .B.l.o.c.k. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776228</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{08edbc40-f085-4664-8cf6-cfb6e9ebe8f6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50006f006c006900630079004100670065006e0074002d0034000000</data>
|
|
<asString>P.o.l.i.c.y.A.g.e.n.t.-.4...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776229</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{542d5137-d23a-4bb4-8d90-9c30857d84bc}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50006f006c006900630079004100670065006e0074002d0035000000</data>
|
|
<asString>P.o.l.i.c.y.A.g.e.n.t.-.5...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776230</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3a5e8a34-82df-4083-a6ed-87ea8ed3507a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>530065006100720063006800460069006c0074006500720048006f00730074002d0031000000</data>
|
|
<asString>S.e.a.r.c.h.F.i.l.t.e.r.H.o.s.t.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776231</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{03843031-9e01-449d-b94b-047c6fbe714c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>530065006100720063006800460069006c0074006500720048006f00730074002d0032000000</data>
|
|
<asString>S.e.a.r.c.h.F.i.l.t.e.r.H.o.s.t.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776232</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{bbe3095e-afe8-4c43-8de5-b9994738a268}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006500610072006300680049006e00640065007800650072002d0031000000</data>
|
|
<asString>S.e.a.r.c.h.I.n.d.e.x.e.r.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776233</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c7031a73-1778-4847-9b46-8ce7fa8798c1}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006500610072006300680049006e00640065007800650072002d0032000000</data>
|
|
<asString>S.e.a.r.c.h.I.n.d.e.x.e.r.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776234</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c0cedbe2-34f4-4491-bd19-152a55b1b6e0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>530065006100720063006800500072006f0074006f0063006f006c0048006f00730074002d0031000000</data>
|
|
<asString>S.e.a.r.c.h.P.r.o.t.o.c.o.l.H.o.s.t.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776235</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{be0ee23e-c670-47d6-8112-7cf182d22041}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53004e004d00500054005200410050002d0032000000</data>
|
|
<asString>S.N.M.P.T.R.A.P.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776236</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{b508cf8d-5dbe-44e9-bc10-85402404c8f4}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53004e004d00500054005200410050002d0033000000</data>
|
|
<asString>S.N.M.P.T.R.A.P.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776237</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{7b84e8bb-fa4a-42c3-b61d-6e2b0532fdc5}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53005000500045005800540043004f004d004f0042004a002d0033000000</data>
|
|
<asString>S.P.P.E.X.T.C.O.M.O.B.J.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776238</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6cc74acd-ca95-45f6-8c3b-5e62000940b0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53005000500045005800540043004f004d004f0042004a002d0034000000</data>
|
|
<asString>S.P.P.E.X.T.C.O.M.O.B.J.-.4...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776239</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f63fb925-3743-4a88-95ed-a842472b93fc}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5300790073006d00610069006e002d0031000000</data>
|
|
<asString>S.y.s.m.a.i.n.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776240</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{0613da54-aa3d-4d9d-afd6-d4d64f655001}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5300790073006d00610069006e002d0032000000</data>
|
|
<asString>S.y.s.m.a.i.n.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776241</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d8e3c9f1-31ab-441a-896a-8c4b0d3b2019}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5400610062006c006500740049006e0070007500740053006500720076006900630065002d0031000000</data>
|
|
<asString>T.a.b.l.e.t.I.n.p.u.t.S.e.r.v.i.c.e.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776242</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{cfcaf1e6-48d2-47d1-a1e3-d7b017af03ee}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5400610062006c006500740049006e0070007500740053006500720076006900630065002d0032000000</data>
|
|
<asString>T.a.b.l.e.t.I.n.p.u.t.S.e.r.v.i.c.e.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776243</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{7b6dc94c-eb68-4c29-9f34-589b83c2f93a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>540072006b0077006b0073002d0031000000</data>
|
|
<asString>T.r.k.w.k.s.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776244</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{42e3bde9-8223-45ae-a948-b331cfad1178}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>540072006b0077006b0073002d0032000000</data>
|
|
<asString>T.r.k.w.k.s.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776245</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f5ce7aa1-73b7-4368-8117-1b81a708a5b8}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>55006d0052006400700053006500720076006900630065002d0031000000</data>
|
|
<asString>U.m.R.d.p.S.e.r.v.i.c.e.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776246</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{09581f72-a5fa-4f0d-83c1-e0a072bb2e5c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>55006d0052006400700053006500720076006900630065002d0032000000</data>
|
|
<asString>U.m.R.d.p.S.e.r.v.i.c.e.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776247</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{89946940-1d3d-4828-baf2-ef863ff4d926}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5600610063005300760063002d0031000000</data>
|
|
<asString>V.a.c.S.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776248</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{09c48c05-27b6-4ee0-99f7-a39203499a80}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5600610063005300760063002d0032000000</data>
|
|
<asString>V.a.c.S.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776249</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{20ba781c-7644-4706-9a3d-3cadb206da34}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5600440053002d0031000000</data>
|
|
<asString>V.D.S.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776250</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{de982dfe-87db-49d3-ab9e-fd063af6cf3e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063006700750065007300740069006e0074006500720066006100630065002d0062006c006f0063006b002d0069006e000000</data>
|
|
<asString>v.m.i.c.g.u.e.s.t.i.n.t.e.r.f.a.c.e.-.b.l.o.c.k.-.i.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776251</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{66d956e2-2f1d-424c-9d3c-48ae68b15ed6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063006700750065007300740069006e0074006500720066006100630065002d0062006c006f0063006b002d006f00750074000000</data>
|
|
<asString>v.m.i.c.g.u.e.s.t.i.n.t.e.r.f.a.c.e.-.b.l.o.c.k.-.o.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776252</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{36a4e3cc-ec47-49eb-977f-e55f10f19083}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063006800650061007200740062006500610074002d0062006c006f0063006b002d0069006e000000</data>
|
|
<asString>v.m.i.c.h.e.a.r.t.b.e.a.t.-.b.l.o.c.k.-.i.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776253</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{8293ae37-bed3-4430-a7a4-68b06342c2e2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063006800650061007200740062006500610074002d0062006c006f0063006b002d006f00750074000000</data>
|
|
<asString>v.m.i.c.h.e.a.r.t.b.e.a.t.-.b.l.o.c.k.-.o.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776254</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{fcc62406-2a46-4704-8605-51da6478c028}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063006b0076007000650078006300680061006e00670065002d0062006c006f0063006b002d0069006e000000</data>
|
|
<asString>v.m.i.c.k.v.p.e.x.c.h.a.n.g.e.-.b.l.o.c.k.-.i.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776255</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{996f6ad1-478b-49a3-9ac5-9278bbfdab90}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063006b0076007000650078006300680061006e00670065002d0062006c006f0063006b002d006f00750074000000</data>
|
|
<asString>v.m.i.c.k.v.p.e.x.c.h.a.n.g.e.-.b.l.o.c.k.-.o.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776256</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c9a666f9-bc1e-4e39-9ee6-52940117aad8}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063007200640076002d0062006c006f0063006b002d0069006e000000</data>
|
|
<asString>v.m.i.c.r.d.v.-.b.l.o.c.k.-.i.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776257</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{19d55ef7-9fd1-43d0-b47c-b7752e875f3e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063007200640076002d0062006c006f0063006b002d006f00750074000000</data>
|
|
<asString>v.m.i.c.r.d.v.-.b.l.o.c.k.-.o.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776258</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{79d972a5-c160-4af7-b091-58da324a4ff0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d0069006300730068007500740064006f0077006e002d0062006c006f0063006b002d0069006e000000</data>
|
|
<asString>v.m.i.c.s.h.u.t.d.o.w.n.-.b.l.o.c.k.-.i.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776259</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2c1956cf-17bc-4820-b44d-522f9985dc29}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d0069006300730068007500740064006f0077006e002d0062006c006f0063006b002d006f00750074000000</data>
|
|
<asString>v.m.i.c.s.h.u.t.d.o.w.n.-.b.l.o.c.k.-.o.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776260</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{0c6406d9-1628-4c44-b2da-b5f8ca525a44}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d0069006300740069006d006500730079006e0063002d0062006c006f0063006b002d0069006e000000</data>
|
|
<asString>v.m.i.c.t.i.m.e.s.y.n.c.-.b.l.o.c.k.-.i.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776261</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f245355c-3927-4d7a-b7eb-57a3db7827c6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d0069006300740069006d006500730079006e0063002d0062006c006f0063006b002d006f00750074000000</data>
|
|
<asString>v.m.i.c.t.i.m.e.s.y.n.c.-.b.l.o.c.k.-.o.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776262</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{b4fc7eca-e42d-4ae1-a29e-bc721cde5535}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d006900630076006d00730065007300730069006f006e002d0062006c006f0063006b002d0069006e000000</data>
|
|
<asString>v.m.i.c.v.m.s.e.s.s.i.o.n.-.b.l.o.c.k.-.i.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776263</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3c267f8e-944d-4068-acad-75ba5821575b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d006900630076006d00730065007300730069006f006e002d0062006c006f0063006b002d006f00750074000000</data>
|
|
<asString>v.m.i.c.v.m.s.e.s.s.i.o.n.-.b.l.o.c.k.-.o.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776264</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c58cd9f2-b4e4-43f5-b494-d7260d82f973}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063007600730073002d0062006c006f0063006b002d0069006e000000</data>
|
|
<asString>v.m.i.c.v.s.s.-.b.l.o.c.k.-.i.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776265</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{1622032e-7b49-4f11-b377-d2c73c90bcc8}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>76006d00690063007600730073002d0062006c006f0063006b002d006f00750074000000</data>
|
|
<asString>v.m.i.c.v.s.s.-.b.l.o.c.k.-.o.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776266</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a5086f3a-f5e4-481e-8caf-1ff0204b001c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7700620065006e00670069006e0065002d0031000000</data>
|
|
<asString>w.b.e.n.g.i.n.e.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776267</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c2733d72-d500-4045-94f2-09606cd6dbc6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7700620065006e00670069006e0065002d0033000000</data>
|
|
<asString>w.b.e.n.g.i.n.e.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776268</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c6f5a818-b954-42a7-b596-45591ca10f6a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>570063006d007300760063002d0031000000</data>
|
|
<asString>W.c.m.s.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776269</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f87d269f-537e-4352-b018-87e5976976f7}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>570063006d007300760063002d0033000000</data>
|
|
<asString>W.c.m.s.v.c.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776270</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{0c3cddb6-de83-4012-8dca-52a7682f97da}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>570064006900530079007300740065006d0048006f00730074002d0031000000</data>
|
|
<asString>W.d.i.S.y.s.t.e.m.H.o.s.t.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776271</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ffd72c64-50dc-4b5b-8b1e-1dfe782f4d0d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>570064006900530079007300740065006d0048006f00730074002d0032000000</data>
|
|
<asString>W.d.i.S.y.s.t.e.m.H.o.s.t.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776272</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{9a09d870-2858-4be6-9e2f-ce10b4907fa0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5700650072005300760063002d0031000000</data>
|
|
<asString>W.e.r.S.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776273</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c54b278f-9127-40bf-aa5e-86674fa65c76}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5700650072005300760063002d0032000000</data>
|
|
<asString>W.e.r.S.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776274</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{690f4ad8-bc37-48b7-bed6-bfa7a526a895}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>570069006e0064006f007700730044006500660065006e006400650072002d0032000000</data>
|
|
<asString>W.i.n.d.o.w.s.D.e.f.e.n.d.e.r.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776275</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{cdfd6c38-1499-44b4-a900-60aa4e8936c2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>570069006e0064006f007700730044006500660065006e006400650072002d0033000000</data>
|
|
<asString>W.i.n.d.o.w.s.D.e.f.e.n.d.e.r.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776276</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{22d7902a-15f9-4e7c-85fa-062e993aa6d5}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>570069006e0048007400740070004100750074006f00500072006f00780079005300760063002d0032000000</data>
|
|
<asString>W.i.n.H.t.t.p.A.u.t.o.P.r.o.x.y.S.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776277</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2810cbd2-88bb-47d7-a215-409c6cd87bee}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>570069006e0048007400740070004100750074006f00500072006f00780079005300760063002d0033000000</data>
|
|
<asString>W.i.n.H.t.t.p.A.u.t.o.P.r.o.x.y.S.v.c.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776278</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{359ad55a-40a5-45e0-91ba-c921ac9cb876}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>57006c0061006e007300760063002d0031000000</data>
|
|
<asString>W.l.a.n.s.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776279</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c9368850-7641-4a64-9c8d-91c38550f267}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>57006c0061006e007300760063002d0032000000</data>
|
|
<asString>W.l.a.n.s.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776280</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e4bb7146-61ab-49c8-b9f3-57e9d27207e1}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>77006c00700061007300760063002d0031000000</data>
|
|
<asString>w.l.p.a.s.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776281</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{478442b4-ce51-424a-991f-9207b636722c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>77006c00700061007300760063002d0033000000</data>
|
|
<asString>w.l.p.a.s.v.c.-.3...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776282</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{10cc650c-46e4-40e3-b9d8-1e34fee2055f}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5700530043002000440065006e007900200041006c006c00200049006e0062006f0075006e0064000000</data>
|
|
<asString>W.S.C. .D.e.n.y. .A.l.l. .I.n.b.o.u.n.d...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776283</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{fece87b4-8033-4dbe-a385-6bc285eb6d78}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5700530043002000440065006e007900200041006c006c0020004f007500740062006f0075006e0064000000</data>
|
|
<asString>W.S.C. .D.e.n.y. .A.l.l. .O.u.t.b.o.u.n.d...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776284</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{9724c57d-1990-4c1f-b17d-8847702bfcef}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5700770061006e005300760063002d0031000000</data>
|
|
<asString>W.w.a.n.S.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776285</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c0ff73ea-8d25-4280-a754-96b67c932869}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>5700770061006e005300760063002d0032000000</data>
|
|
<asString>W.w.a.n.S.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776286</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ed046545-5b2c-4368-b04e-e93ca55def93}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>410073007300690067006e00650064004100630063006500730073004d0061006e0061006700650072005300760063002d0031000000</data>
|
|
<asString>A.s.s.i.g.n.e.d.A.c.c.e.s.s.M.a.n.a.g.e.r.S.v.c.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776287</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{1b7af7da-20ed-4fb5-9eb4-3e63fcb7536c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>410073007300690067006e00650064004100630063006500730073004d0061006e0061006700650072005300760063002d0032000000</data>
|
|
<asString>A.s.s.i.g.n.e.d.A.c.c.e.s.s.M.a.n.a.g.e.r.S.v.c.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776288</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6796b00a-0007-4eeb-b176-41c6807585a4}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>63006c006f0075006400690064007300760063002d0062006c006f0063006b002d0069006e000000</data>
|
|
<asString>c.l.o.u.d.i.d.s.v.c.-.b.l.o.c.k.-.i.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776289</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{774ac201-15c6-444f-82c9-1dcdff4326f2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>63006c006f0075006400690064007300760063002d0062006c006f0063006b002d006f00750074000000</data>
|
|
<asString>c.l.o.u.d.i.d.s.v.c.-.b.l.o.c.k.-.o.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776290</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{b47fa28f-cdca-41e8-8360-733d8216d7f9}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>43007300630053006500720076006900630065002d0031000000</data>
|
|
<asString>C.s.c.S.e.r.v.i.c.e.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776291</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6e9a9b45-a4cb-4723-bd55-60149243222d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>43007300630053006500720076006900630065002d0032000000</data>
|
|
<asString>C.s.c.S.e.r.v.i.c.e.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776292</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{5845f29b-b4a1-4df2-b66e-609e5f902183}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50006500650072004400690073007400200042006c006f0063006b00200049006e000000</data>
|
|
<asString>P.e.e.r.D.i.s.t. .B.l.o.c.k. .I.n...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776293</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e22f0814-cca5-4de3-8991-4f296ccec7a5}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>50006500650072004400690073007400200042006c006f0063006b0020004f00750074000000</data>
|
|
<asString>P.e.e.r.D.i.s.t. .B.l.o.c.k. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776294</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{66e8985e-169a-4c11-9701-40419c45a9cc}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>57005000440042005500530045004e0055004d002d0031000000</data>
|
|
<asString>W.P.D.B.U.S.E.N.U.M.-.1...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776295</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{cfef2756-ac04-449a-b6c6-ed010f460651}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>57005000440042005500530045004e0055004d002d0032000000</data>
|
|
<asString>W.P.D.B.U.S.E.N.U.M.-.2...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776296</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2d39a837-d11e-4242-aa55-d55d0d92ae68}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>640064003400340036003600360033002d0030003000380036002d0034006100390037002d0038003000370061002d006100380033006500390035006400640038003400640038000000</data>
|
|
<asString>d.d.4.4.6.6.6.3.-.0.0.8.6.-.4.a.9.7.-.8.0.7.a.-.a.8.3.e.9.5.d.d.8.4.d.8...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776297</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{19d6b0d9-e808-4803-a59f-92ae87bf4b00}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>300033006400320066006500650030002d0031006100640065002d0034003800610036002d0061003700640030002d003100390033006200610064003000310035003100330038000000</data>
|
|
<asString>0.3.d.2.f.e.e.0.-.1.a.d.e.-.4.8.a.6.-.a.7.d.0.-.1.9.3.b.a.d.0.1.5.1.3.8...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776298</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{522717a3-989a-403d-8bd9-2301754f6bd4}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00340038003500440036003700310044002d0041003500330037002d0034003800410037002d0039003000440035002d003600370038003300380041003500420041004100320045007d000000</data>
|
|
<asString>{.4.8.5.D.6.7.1.D.-.A.5.3.7.-.4.8.A.7.-.9.0.D.5.-.6.7.8.3.8.A.5.B.A.A.2.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776299</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{fcb5f99f-cabd-4580-b4f4-d8bb7629abd2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310043003100420039003600340036002d0032004200340046002d0034003300450046002d0038004300350042002d003300460039003000300042003700310034004100410042007d000000</data>
|
|
<asString>{.1.C.1.B.9.6.4.6.-.2.B.4.F.-.4.3.E.F.-.8.C.5.B.-.3.F.9.0.0.B.7.1.4.A.A.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776300</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{68d4ff07-c138-454b-aa7e-316622d0a73c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310044004400440045003200300038002d0032004500330032002d0034003200410045002d0038003800380046002d004200440043003200380038003000380036004500300032007d000000</data>
|
|
<asString>{.1.D.D.D.E.2.0.8.-.2.E.3.2.-.4.2.A.E.-.8.8.8.F.-.B.D.C.2.8.8.0.8.6.E.0.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776301</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4237d279-1e81-4828-958f-467bf3a5349b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00360038003600420038003300350039002d0031003200330043002d0034003100370032002d0042003100330033002d004200390032003000350030003900320036003300440033007d000000</data>
|
|
<asString>{.6.8.6.B.8.3.5.9.-.1.2.3.C.-.4.1.7.2.-.B.1.3.3.-.B.9.2.0.5.0.9.2.6.3.D.3.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776302</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6a19fa7f-ef2b-42cf-b2d6-8139181d816b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450045003400340044004100450041002d0034003100390036002d0034003000450036002d0041003900370030002d003500340038003500330043004400460045003900440041007d000000</data>
|
|
<asString>{.E.E.4.4.D.A.E.A.-.4.1.9.6.-.4.0.E.6.-.A.9.7.0.-.5.4.8.5.3.C.D.F.E.9.D.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776303</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{52026488-b6af-4372-9685-0d69706e6683}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00330038004300380037004200360045002d0034004600410031002d0034004400440043002d0042004300460043002d003600360033004500450035003600450030004300430030007d000000</data>
|
|
<asString>{.3.8.C.8.7.B.6.E.-.4.F.A.1.-.4.D.D.C.-.B.C.F.C.-.6.6.3.E.E.5.6.E.0.C.C.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776304</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{249d04ff-49a5-4e08-87e9-0e68e2019df7}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00460041004400390039003200330043002d0034003900320030002d0034003200310030002d0038004400300042002d003400310030004600300039003100440043004300300043007d000000</data>
|
|
<asString>{.F.A.D.9.9.2.3.C.-.4.9.2.0.-.4.2.1.0.-.8.D.0.B.-.4.1.0.F.0.9.1.D.C.C.0.C.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776305</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{cbc261c4-d5fd-4e97-8de5-9c64f045fbb0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440034004100460032003900380030002d0039004600370038002d0034004300390041002d0039003700430030002d003800390046003300360030004300390042004300380039007d000000</data>
|
|
<asString>{.D.4.A.F.2.9.8.0.-.9.F.7.8.-.4.C.9.A.-.9.7.C.0.-.8.9.F.3.6.0.C.9.B.C.8.9.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776306</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f369fb4f-039a-40d7-89c4-e9d1636f38e1}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00460033004300450030003900350037002d0042004600320039002d0034003200300035002d0038003000350046002d003800450033004400350045003000390037003300340042007d000000</data>
|
|
<asString>{.F.3.C.E.0.9.5.7.-.B.F.2.9.-.4.2.0.5.-.8.0.5.F.-.8.E.3.D.5.E.0.9.7.3.4.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776307</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c29535e1-3bbf-4491-bfe8-020381591955}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370044003900370038003700380042002d0043003900310041002d0034003200460034002d0038003700360034002d003300440037004500320030003400310038003400370030007d000000</data>
|
|
<asString>{.7.D.9.7.8.7.8.B.-.C.9.1.A.-.4.2.F.4.-.8.7.6.4.-.3.D.7.E.2.0.4.1.8.4.7.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776308</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{b1f4be4b-02f3-4fe6-9da0-489362bd0b71}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00410042003600410042004400320035002d0038003300420030002d0034003200390030002d0041003700420045002d003400340035003300410042003000370035003100460031007d000000</data>
|
|
<asString>{.A.B.6.A.B.D.2.5.-.8.3.B.0.-.4.2.9.0.-.A.7.B.E.-.4.4.5.3.A.B.0.7.5.1.F.1.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776309</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{7eb2b4ea-2142-4c7e-a44f-ebb62240040d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00360038003300380041003400340035002d0030004200460033002d0034004500390046002d0042004500410044002d004400320045003900420044003700320042004500460044007d000000</data>
|
|
<asString>{.6.8.3.8.A.4.4.5.-.0.B.F.3.-.4.E.9.F.-.B.E.A.D.-.D.2.E.9.B.D.7.2.B.E.F.D.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776310</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{176827d1-c164-4c39-8c31-3afecc6a8b87}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430044003500440034003000450046002d0042004500350036002d0034003500440034002d0042003400300035002d003900350031003500450038004400310034003300410037007d000000</data>
|
|
<asString>{.C.D.5.D.4.0.E.F.-.B.E.5.6.-.4.5.D.4.-.B.4.0.5.-.9.5.1.5.E.8.D.1.4.3.A.7.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776311</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{5f6a0bbb-a184-4846-b780-05f78b81c312}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370034004600340043004500410031002d0032003600430031002d0034003100440036002d0038003900450042002d004400430033003700450037004600310039003600410033007d000000</data>
|
|
<asString>{.7.4.F.4.C.E.A.1.-.2.6.C.1.-.4.1.D.6.-.8.9.E.B.-.D.C.3.7.E.7.F.1.9.6.A.3.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776312</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2b60bea0-0fb8-431e-b6bc-2ecb692ddb06}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00390035003700300036004600330030002d0045004400300035002d0034004500370043002d0041003800440041002d003300350045004500360037003700420036003000360042007d000000</data>
|
|
<asString>{.9.5.7.0.6.F.3.0.-.E.D.0.5.-.4.E.7.C.-.A.8.D.A.-.3.5.E.E.6.7.7.B.6.0.6.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776313</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{39ba4b09-2547-445d-a928-30377b0904fc}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450032004500430033003600380038002d0046003000300035002d0034004200430036002d0041003700420046002d003100360032003900410042004600350031003000300041007d000000</data>
|
|
<asString>{.E.2.E.C.3.6.8.8.-.F.0.0.5.-.4.B.C.6.-.A.7.B.F.-.1.6.2.9.A.B.F.5.1.0.0.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776314</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{eab91178-7ca7-4e7c-9c51-b0fb5529aeec}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310034003500420039003500350046002d0038003200430041002d0034003700360036002d0038004600430037002d004500360033003700330039003000370042004400390046007d000000</data>
|
|
<asString>{.1.4.5.B.9.5.5.F.-.8.2.C.A.-.4.7.6.6.-.8.F.C.7.-.E.6.3.7.3.9.0.7.B.D.9.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776315</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{172590db-b33f-47df-9a24-df562ac3ec0f}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320032003000370041004400310042002d0034003600330036002d0034003100340033002d0038004100390034002d004100310041003400330041003100310032004300330042007d000000</data>
|
|
<asString>{.2.2.0.7.A.D.1.B.-.4.6.3.6.-.4.1.4.3.-.8.A.9.4.-.A.1.A.4.3.A.1.1.2.C.3.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776316</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6a3f64d4-864f-42ed-9dd8-30a826e49a5a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320046004500440031003700460037002d0033003000300039002d0034003800440043002d0041003600320036002d003200360030004400420046004500370039003400310035007d000000</data>
|
|
<asString>{.2.F.E.D.1.7.F.7.-.3.0.0.9.-.4.8.D.C.-.A.6.2.6.-.2.6.0.D.B.F.E.7.9.4.1.5.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776317</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{74988442-3bfb-451c-9a63-9eabb07c4485}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300031003200340036004100430030002d0043003800340039002d0034003100370036002d0042003400330030002d003500440046003000350046004600330041003200370036007d000000</data>
|
|
<asString>{.0.1.2.4.6.A.C.0.-.C.8.4.9.-.4.1.7.6.-.B.4.3.0.-.5.D.F.0.5.F.F.3.A.2.7.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776318</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{5f35226f-d9fa-4d44-8136-27a1c662a034}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00410033004400440044004200360043002d0041003800300043002d0034004300450033002d0039003400420036002d003400320035004500390045004400380037004200390044007d000000</data>
|
|
<asString>{.A.3.D.D.D.B.6.C.-.A.8.0.C.-.4.C.E.3.-.9.4.B.6.-.4.2.5.E.9.E.D.8.7.B.9.D.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776319</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ee701874-f029-4ad6-b10b-a96448806f5e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00360030003700390035003700380033002d0037004100340043002d0034003700380035002d0041003100300037002d003600380043003900350036004100330042004500380037007d000000</data>
|
|
<asString>{.6.0.7.9.5.7.8.3.-.7.A.4.C.-.4.7.8.5.-.A.1.0.7.-.6.8.C.9.5.6.A.3.B.E.8.7.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776320</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f51c59dd-efbf-4d67-8098-1ed8362db864}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310037004200450034004600360034002d0033004500360031002d0034004200420037002d0039003400450031002d003200330042004500320042003800320038004600330038007d000000</data>
|
|
<asString>{.1.7.B.E.4.F.6.4.-.3.E.6.1.-.4.B.B.7.-.9.4.E.1.-.2.3.B.E.2.B.8.2.8.F.3.8.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776321</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4118e8a8-7bc3-4cfa-bc76-b58807f4b331}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300037004500340031004500350039002d0032004100330036002d0034003700300036002d0039003200310041002d003500420038003200410037003900380043004600350042007d000000</data>
|
|
<asString>{.0.7.E.4.1.E.5.9.-.2.A.3.6.-.4.7.0.6.-.9.2.1.A.-.5.B.8.2.A.7.9.8.C.F.5.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776322</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4cb1e008-1717-41de-b54b-002f7f5ee7ed}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00410041003900420033003900370044002d0030003700360042002d0034003700390042002d0042004600310046002d003500390034003100350044004400430030004300390046007d000000</data>
|
|
<asString>{.A.A.9.B.3.9.7.D.-.0.7.6.B.-.4.7.9.B.-.B.F.1.F.-.5.9.4.1.5.D.D.C.0.C.9.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776323</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c78cca83-d284-4994-afa2-36f2d141092d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440046003600310037004500420035002d0042003400450044002d0034004500410038002d0039003700420039002d004100360038003300460045004400330035004500350031007d000000</data>
|
|
<asString>{.D.F.6.1.7.E.B.5.-.B.4.E.D.-.4.E.A.8.-.9.7.B.9.-.A.6.8.3.F.E.D.3.5.E.5.1.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776324</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3992e37e-b141-4b1e-97c7-91a13aad3f4d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430032003800340030004100430043002d0032003500300034002d0034003300430046002d0038003900460045002d004200380035004500440044003600360034003400320032007d000000</data>
|
|
<asString>{.C.2.8.4.0.A.C.C.-.2.5.0.4.-.4.3.C.F.-.8.9.F.E.-.B.8.5.E.D.D.6.6.4.4.2.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776325</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{05ec7931-2f4c-41be-a2ea-6d51d1bbbece}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00460044003800390030003600430042002d0045004400430033002d0034003500320031002d0038003000370037002d004600330036004600410038004400320038003900410044007d000000</data>
|
|
<asString>{.F.D.8.9.0.6.C.B.-.E.D.C.3.-.4.5.2.1.-.8.0.7.7.-.F.3.6.F.A.8.D.2.8.9.A.D.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776326</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{99d123c2-3b7b-4ed4-9ec8-db4045ecab9c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370037003800310044003600460038002d0036003100420046002d0034004500310030002d0042003400310042002d003000350045004200420045003800340036004500390045007d000000</data>
|
|
<asString>{.7.7.8.1.D.6.F.8.-.6.1.B.F.-.4.E.1.0.-.B.4.1.B.-.0.5.E.B.B.E.8.4.6.E.9.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776327</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f1e8ae28-b94f-4ea4-8146-effcf1aab52d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350037003800340038004300320043002d0044003800310034002d0034003600450036002d0041003500360030002d003000330043003700390035003700330039003400330041007d000000</data>
|
|
<asString>{.5.7.8.4.8.C.2.C.-.D.8.1.4.-.4.6.E.6.-.A.5.6.0.-.0.3.C.7.9.5.7.3.9.4.3.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776328</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f110ffcf-96c3-4478-bb37-1b945cb78a70}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370030003400320031004100330042002d0045003900410039002d0034003000360043002d0039003400350036002d003400430044003000380030003300430046003000350041007d000000</data>
|
|
<asString>{.7.0.4.2.1.A.3.B.-.E.9.A.9.-.4.0.6.C.-.9.4.5.6.-.4.C.D.0.8.0.3.C.F.0.5.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776329</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f981bff2-8c56-445e-8cb7-96a027e9f6b1}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00420041004500300032004400420044002d0032003600420031002d0034004100340037002d0039003200390030002d003400300030003200360043003800380043003900390034007d000000</data>
|
|
<asString>{.B.A.E.0.2.D.B.D.-.2.6.B.1.-.4.A.4.7.-.9.2.9.0.-.4.0.0.2.6.C.8.8.C.9.9.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776330</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{fefb887e-0b75-460c-9c27-d56487aac61a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320033003600390033004600450030002d0031003800380039002d0034003500320044002d0039004600450030002d004100390045004600420030003000390033003700330042007d000000</data>
|
|
<asString>{.2.3.6.9.3.F.E.0.-.1.8.8.9.-.4.5.2.D.-.9.F.E.0.-.A.9.E.F.B.0.0.9.3.7.3.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776331</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{160c36c9-0822-478c-95ee-e5f979416fbb}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350033003200380036004400320043002d0043004400460046002d0034003900450035002d0039004600320039002d004400370043004500450043004100440037003900410036007d000000</data>
|
|
<asString>{.5.3.2.8.6.D.2.C.-.C.D.F.F.-.4.9.E.5.-.9.F.2.9.-.D.7.C.E.E.C.A.D.7.9.A.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776332</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a005febd-1b7b-4a86-90cc-92d03d4ef881}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440041003700430032004600380033002d0030004200370031002d0034004600300044002d0042004200350030002d003700460039003300390032004200380031003000380032007d000000</data>
|
|
<asString>{.D.A.7.C.2.F.8.3.-.0.B.7.1.-.4.F.0.D.-.B.B.5.0.-.7.F.9.3.9.2.B.8.1.0.8.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776333</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d1a7f6b9-32b7-43f3-9c54-729684ef4756}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00460037003400360033003500310031002d0039004400300030002d0034004300420045002d0041003300420031002d003900430031004100350031003100360042004100310032007d000000</data>
|
|
<asString>{.F.7.4.6.3.5.1.1.-.9.D.0.0.-.4.C.B.E.-.A.3.B.1.-.9.C.1.A.5.1.1.6.B.A.1.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776334</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{eb407abd-ec36-44d8-8fc6-881762cd0741}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430038004300410039004500310043002d0039003800370038002d0034004100440044002d0038003000450033002d003700420045003700360035003000330041004600340045007d000000</data>
|
|
<asString>{.C.8.C.A.9.E.1.C.-.9.8.7.8.-.4.A.D.D.-.8.0.E.3.-.7.B.E.7.6.5.0.3.A.F.4.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776335</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f38530b7-9907-4f2e-be76-f1071e6395f0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00340039004600330032003800430042002d0044003500320046002d0034004100340044002d0041003800430032002d003900320036004200440034003600300037003800360038007d000000</data>
|
|
<asString>{.4.9.F.3.2.8.C.B.-.D.5.2.F.-.4.A.4.D.-.A.8.C.2.-.9.2.6.B.D.4.6.0.7.8.6.8.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776336</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{45f882ef-306e-4e41-bf2b-e06259932b00}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00380031003400440032003200450033002d0046003000440042002d0034003900380034002d0039003800330046002d004200430033003200360039003600420045003000460031007d000000</data>
|
|
<asString>{.8.1.4.D.2.2.E.3.-.F.0.D.B.-.4.9.8.4.-.9.8.3.F.-.B.C.3.2.6.9.6.B.E.0.F.1.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776337</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2e30c355-e9ed-49ce-a635-266a4440be9e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440045003400300036003700420035002d0044003000310044002d0034004600370046002d0039003500420039002d004200430041003500360045004100430041004600410041007d000000</data>
|
|
<asString>{.D.E.4.0.6.7.B.5.-.D.0.1.D.-.4.F.7.F.-.9.5.B.9.-.B.C.A.5.6.E.A.C.A.F.A.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776338</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a5a5784f-7482-4fb0-8f7d-d76ea07b5573}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300035003400460038004100420046002d0039003200330039002d0034003800460032002d0041004300450031002d003000360038003000310030003200420042004100430036007d000000</data>
|
|
<asString>{.0.5.4.F.8.A.B.F.-.9.2.3.9.-.4.8.F.2.-.A.C.E.1.-.0.6.8.0.1.0.2.B.B.A.C.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776339</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e5c91f00-cb28-4d70-8ef2-9351c595e63e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00420032004300330045003700330045002d0035004400390038002d0034004200330037002d0038004100440032002d004600410036003900300035003400350037003800320045007d000000</data>
|
|
<asString>{.B.2.C.3.E.7.3.E.-.5.D.9.8.-.4.B.3.7.-.8.A.D.2.-.F.A.6.9.0.5.4.5.7.8.2.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776340</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{13e654d8-0311-4b2b-937c-1f01e46ffbb2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310046003500430043003400460036002d0030004100440042002d0034003200450044002d0042003500430043002d003100350045004200350045004200390030003100430034007d000000</data>
|
|
<asString>{.1.F.5.C.C.4.F.6.-.0.A.D.B.-.4.2.E.D.-.B.5.C.C.-.1.5.E.B.5.E.B.9.0.1.C.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776341</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{df298d75-3e7f-4e8d-8b55-f56b4926c82f}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450034004500330044003300310033002d0038003500450033002d0034004300450030002d0041003100330030002d003500380035004400430039003600370041004400360036007d000000</data>
|
|
<asString>{.E.4.E.3.D.3.1.3.-.8.5.E.3.-.4.C.E.0.-.A.1.3.0.-.5.8.5.D.C.9.6.7.A.D.6.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776342</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{9521e687-22a1-418f-bce2-7eb7fe25070a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00340033003000310042004300350039002d0032004100450045002d0034003500410038002d0039003600340038002d004600360031004200330035003400320030003500320046007d000000</data>
|
|
<asString>{.4.3.0.1.B.C.5.9.-.2.A.E.E.-.4.5.A.8.-.9.6.4.8.-.F.6.1.B.3.5.4.2.0.5.2.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776343</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{db42024e-f9e7-4f03-b4c3-94fb3db7f934}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00390044003600420033003300320041002d0046003500320032002d0034003400430036002d0042003400380044002d003900430043004300340035003200330037003900380036007d000000</data>
|
|
<asString>{.9.D.6.B.3.3.2.A.-.F.5.2.2.-.4.4.C.6.-.B.4.8.D.-.9.C.C.C.4.5.2.3.7.9.8.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776344</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{35f3ec13-352d-4b4d-80e7-0745db50321e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350041003300330032003700430037002d0033003500380035002d0034004600460043002d0039004200390042002d004100380044004400310037004400380031004600380033007d000000</data>
|
|
<asString>{.5.A.3.3.2.7.C.7.-.3.5.8.5.-.4.F.F.C.-.9.B.9.B.-.A.8.D.D.1.7.D.8.1.F.8.3.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776345</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{0de8b3b5-a43a-4651-9397-f7a2a5c86ec6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00360038003900310046003600460036002d0032003500320035002d0034004600420032002d0039003300330045002d003900450046003000370046003300380033003300350044007d000000</data>
|
|
<asString>{.6.8.9.1.F.6.F.6.-.2.5.2.5.-.4.F.B.2.-.9.3.3.E.-.9.E.F.0.7.F.3.8.3.3.5.D.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776346</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{23729a28-9e77-4000-a175-0d3ace63d138}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00330034003800390034003600390032002d0036003500380031002d0034003500440035002d0041004200450044002d003000440036003400350039003500360032004400320041007d000000</data>
|
|
<asString>{.3.4.8.9.4.6.9.2.-.6.5.8.1.-.4.5.D.5.-.A.B.E.D.-.0.D.6.4.5.9.5.6.2.D.2.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776347</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{1588f8a1-b166-48f6-bef3-a2918b2b4b2e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440036004200430039003000420046002d0035004400340043002d0034003200420038002d0042004200380031002d004400330030004200350045003500390033003300300043007d000000</data>
|
|
<asString>{.D.6.B.C.9.0.B.F.-.5.D.4.C.-.4.2.B.8.-.B.B.8.1.-.D.3.0.B.5.E.5.9.3.3.0.C.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776348</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{eeefb14f-6d56-4ad8-9a0d-6906e0f27143}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370036003900310046003900420034002d0031004400310031002d0034003900360030002d0038003800310045002d003400320030003100440045003100330031004100340034007d000000</data>
|
|
<asString>{.7.6.9.1.F.9.B.4.-.1.D.1.1.-.4.9.6.0.-.8.8.1.E.-.4.2.0.1.D.E.1.3.1.A.4.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776349</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ef018b97-7b72-4cdb-8f9e-6cda465099ad}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320042003100440036003200350045002d0041004500350039002d0034004300430037002d0039003500300044002d004200320035004400340046004600340043004100370039007d000000</data>
|
|
<asString>{.2.B.1.D.6.2.5.E.-.A.E.5.9.-.4.C.C.7.-.9.5.0.D.-.B.2.5.D.4.F.F.4.C.A.7.9.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776350</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{70e5215e-c496-4954-a024-485e29f64ed1}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320030004400330039003200300030002d0034004600330044002d0034004300330037002d0039004500370035002d004600370037003400310032004500430045003900300036007d000000</data>
|
|
<asString>{.2.0.D.3.9.2.0.0.-.4.F.3.D.-.4.C.3.7.-.9.E.7.5.-.F.7.7.4.1.2.E.C.E.9.0.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776351</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{57ca4bf8-eb85-4596-b0f5-93f3f457c9da}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00340031003500440041003600430045002d0035004500390041002d0034003400360032002d0039004100310046002d004400370039004600340037003700460031003900410035007d000000</data>
|
|
<asString>{.4.1.5.D.A.6.C.E.-.5.E.9.A.-.4.4.6.2.-.9.A.1.F.-.D.7.9.F.4.7.7.F.1.9.A.5.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776352</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4b3fce1f-7c65-4f21-9cb6-12610863dc49}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440037004100460035003800320034002d0042003100430044002d0034004300360037002d0042003100440033002d003800350044003500330038003800310041004100340039007d000000</data>
|
|
<asString>{.D.7.A.F.5.8.2.4.-.B.1.C.D.-.4.C.6.7.-.B.1.D.3.-.8.5.D.5.3.8.8.1.A.A.4.9.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776353</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a0789b38-a6a5-44c8-aee7-cb273954a2c0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430035003500330035004200370043002d0031003900390044002d0034003000380032002d0041003100380034002d004400430030003300350043003300430035003800390038007d000000</data>
|
|
<asString>{.C.5.5.3.5.B.7.C.-.1.9.9.D.-.4.0.8.2.-.A.1.8.4.-.D.C.0.3.5.C.3.C.5.8.9.8.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776354</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{7954653e-00d4-493b-bf75-a7df7811caca}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00330032003000320037004200410041002d0046004400420044002d0034003200330030002d0041003900450035002d004100460034004600330037003200410037003400350042007d000000</data>
|
|
<asString>{.3.2.0.2.7.B.A.A.-.F.D.B.D.-.4.2.3.0.-.A.9.E.5.-.A.F.4.F.3.7.2.A.7.4.5.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776355</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{986ffd0c-9682-4e34-93ee-18282e6fc7e4}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00410043003200410042003000430045002d0045004400390036002d0034003500350041002d0039003100430035002d003100440039004200430046004100330043003100380037007d000000</data>
|
|
<asString>{.A.C.2.A.B.0.C.E.-.E.D.9.6.-.4.5.5.A.-.9.1.C.5.-.1.D.9.B.C.F.A.3.C.1.8.7.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776356</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c4a200b8-5ef7-4b22-990c-3de8576a89c2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00460042003400320039004600380038002d0039003400340039002d0034004300440046002d0041003600390032002d003700450034003800440035003200450045004500460041007d000000</data>
|
|
<asString>{.F.B.4.2.9.F.8.8.-.9.4.4.9.-.4.C.D.F.-.A.6.9.2.-.7.E.4.8.D.5.2.E.E.E.F.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776357</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{5504179a-041a-4796-902c-9d29d6461739}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350037003300300032004100430032002d0036003000460039002d0034003700410034002d0038003400330035002d004600420041004600450030003800300036004400320041007d000000</data>
|
|
<asString>{.5.7.3.0.2.A.C.2.-.6.0.F.9.-.4.7.A.4.-.8.4.3.5.-.F.B.A.F.E.0.8.0.6.D.2.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776358</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f8a49d92-f357-4994-8b2a-a3cbed9d995b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00420039003900340034004300370046002d0037003100390030002d0034004300340045002d0041004100380046002d004400370033003600460034004200370042003900340041007d000000</data>
|
|
<asString>{.B.9.9.4.4.C.7.F.-.7.1.9.0.-.4.C.4.E.-.A.A.8.F.-.D.7.3.6.F.4.B.7.B.9.4.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776359</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ccee2909-294e-4ad6-b0ef-fa93cdf3d2b5}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00340045003100450038003500330036002d0046004600450037002d0034003200420039002d0042003500340035002d003900380030004400330045003200300030003700300044007d000000</data>
|
|
<asString>{.4.E.1.E.8.5.3.6.-.F.F.E.7.-.4.2.B.9.-.B.5.4.5.-.9.8.0.D.3.E.2.0.0.7.0.D.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776360</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3aaefe3a-4f84-40da-a38a-319c198ac067}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00380042003100390046003900440034002d0033004200460045002d0034003900300030002d0041004200430033002d004400410039003100380037003600410044003400320043007d000000</data>
|
|
<asString>{.8.B.1.9.F.9.D.4.-.3.B.F.E.-.4.9.0.0.-.A.B.C.3.-.D.A.9.1.8.7.6.A.D.4.2.C.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776361</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2fceaed8-43de-431e-9e1c-248e4f8f43e1}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320041004400370033004500310035002d0041004400380041002d0034004500310037002d0042004200450030002d004200420038003200450039003600360046003900360045007d000000</data>
|
|
<asString>{.2.A.D.7.3.E.1.5.-.A.D.8.A.-.4.E.1.7.-.B.B.E.0.-.B.B.8.2.E.9.6.6.F.9.6.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776362</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a2ddf546-d32c-4a74-b522-12c269bee88f}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00390035003500410034003800350041002d0039004600300036002d0034004100360043002d0041003900360044002d004100330042003500430046003600390046004200350042007d000000</data>
|
|
<asString>{.9.5.5.A.4.8.5.A.-.9.F.0.6.-.4.A.6.C.-.A.9.6.D.-.A.3.B.5.C.F.6.9.F.B.5.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776363</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{8852c503-6be2-4850-b366-41a3600b3c14}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370043003100330033003900300038002d0030003500330045002d0034003800350039002d0039004400360034002d004600300031003300440031004100410035003600300036007d000000</data>
|
|
<asString>{.7.C.1.3.3.9.0.8.-.0.5.3.E.-.4.8.5.9.-.9.D.6.4.-.F.0.1.3.D.1.A.A.5.6.0.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776364</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d02a7aa2-6454-4fd6-82fb-b198cef82a49}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430043003100410039004200390046002d0046004200420033002d0034003300300045002d0039004200350033002d004300380039003800420035003400380039003100430036007d000000</data>
|
|
<asString>{.C.C.1.A.9.B.9.F.-.F.B.B.3.-.4.3.0.E.-.9.B.5.3.-.C.8.9.8.B.5.4.8.9.1.C.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776365</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{577bdf7b-b66e-4aa7-8c1e-0056a2312d4d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00360032003500340043003500440044002d0036004600430039002d0034003900460030002d0038004300350039002d003400350030004200440033004600320039003100390038007d000000</data>
|
|
<asString>{.6.2.5.4.C.5.D.D.-.6.F.C.9.-.4.9.F.0.-.8.C.5.9.-.4.5.0.B.D.3.F.2.9.1.9.8.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776366</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e972b787-cefb-4018-8a07-cb56fb335d05}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440043004200370044003300310041002d0043003600440030002d0034004500340037002d0042003300380034002d003200460039003400430030003400440030003300360034007d000000</data>
|
|
<asString>{.D.C.B.7.D.3.1.A.-.C.6.D.0.-.4.E.4.7.-.B.3.8.4.-.2.F.9.4.C.0.4.D.0.3.6.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776367</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a1c1ada8-14c5-436e-a4c1-9ed9a31cf907}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430037004200320036004100450043002d0038003800440044002d0034004300390030002d0039003100310043002d004100410037003500350031003500440039003600360041007d000000</data>
|
|
<asString>{.C.7.B.2.6.A.E.C.-.8.8.D.D.-.4.C.9.0.-.9.1.1.C.-.A.A.7.5.5.1.5.D.9.6.6.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776368</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{000023c2-38de-4459-b661-d03163e40e3a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00360046004400350033003700420035002d0036004300330031002d0034003500380042002d0038003900310033002d003400440042004100440041003700430030003000340030007d000000</data>
|
|
<asString>{.6.F.D.5.3.7.B.5.-.6.C.3.1.-.4.5.8.B.-.8.9.1.3.-.4.D.B.A.D.A.7.C.0.0.4.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776369</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{98008b68-29a7-4a99-ab26-95244c6f3f54}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320037003400320035004500360031002d0031003600450037002d0034003400370030002d0038004600410042002d003600440041004400430041004600320038003000380035007d000000</data>
|
|
<asString>{.2.7.4.2.5.E.6.1.-.1.6.E.7.-.4.4.7.0.-.8.F.A.B.-.6.D.A.D.C.A.F.2.8.0.8.5.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776370</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{43241563-341c-4081-a5c8-5936cf234f41}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450030004400420037003000330041002d0036003800410045002d0034003200410045002d0042004600410035002d003200390036003400390039004200300033004200450031007d000000</data>
|
|
<asString>{.E.0.D.B.7.0.3.A.-.6.8.A.E.-.4.2.A.E.-.B.F.A.5.-.2.9.6.4.9.9.B.0.3.B.E.1.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776371</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{447f6038-491e-4529-bc1e-a587cba618a3}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450041003900330032004500410041002d0036004300460043002d0034003200390042002d0042003700320035002d003000370044004100440033004400330035003000450044007d000000</data>
|
|
<asString>{.E.A.9.3.2.E.A.A.-.6.C.F.C.-.4.2.9.B.-.B.7.2.5.-.0.7.D.A.D.3.D.3.5.0.E.D.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776372</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{5c41bff6-8bf5-48af-b42e-3b913be0d81f}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350031004200450041003600460041002d0042004400350033002d0034003200350038002d0041003600420035002d003500430044003400410044003300300031004600310033007d000000</data>
|
|
<asString>{.5.1.B.E.A.6.F.A.-.B.D.5.3.-.4.2.5.8.-.A.6.B.5.-.5.C.D.4.A.D.3.0.1.F.1.3.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776373</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{978930af-c0d6-4296-ae53-cabba5589a56}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440035003500360034004100350046002d0039003800320038002d0034003600360031002d0039004600430043002d004200460045003200320039003200460043003300370033007d000000</data>
|
|
<asString>{.D.5.5.6.4.A.5.F.-.9.8.2.8.-.4.6.6.1.-.9.F.C.C.-.B.F.E.2.2.9.2.F.C.3.7.3.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776374</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{848b440e-9599-4a74-b7d7-e85f5eabbee0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00330035003700410044004300300030002d0041003400450044002d0034004200370035002d0039003500460033002d003700410030003600370035004600440036003800320045007d000000</data>
|
|
<asString>{.3.5.7.A.D.C.0.0.-.A.4.E.D.-.4.B.7.5.-.9.5.F.3.-.7.A.0.6.7.5.F.D.6.8.2.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776375</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{074dbf65-e26f-4e48-bcf6-2e6308011093}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00390045003900320033003700390041002d0031004600370044002d0034003400430044002d0042004400380046002d004400450041003400300033003600360031003000330045007d000000</data>
|
|
<asString>{.9.E.9.2.3.7.9.A.-.1.F.7.D.-.4.4.C.D.-.B.D.8.F.-.D.E.A.4.0.3.6.6.1.0.3.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776376</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{8ebcef68-f34d-4139-8b85-7b57334b9329}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310037003100350031003900310046002d0035003100450038002d0034003900320046002d0038003800460044002d004500440043003000330044003500370045004600370042007d000000</data>
|
|
<asString>{.1.7.1.5.1.9.1.F.-.5.1.E.8.-.4.9.2.F.-.8.8.F.D.-.E.D.C.0.3.D.5.7.E.F.7.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776377</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{152c9c3b-b07e-486e-a750-7d561d75f843}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450043003600410039003600330039002d0035003300360035002d0034003600430041002d0042004400460042002d004500350041004100300039003300420035004200460045007d000000</data>
|
|
<asString>{.E.C.6.A.9.6.3.9.-.5.3.6.5.-.4.6.C.A.-.B.D.F.B.-.E.5.A.A.0.9.3.B.5.B.F.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776378</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4c37bb57-9bdf-4ab2-891f-cccdbc2b0d0c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440041003600320046003000300041002d0041003000350034002d0034004600420032002d0038004600370033002d003100370031004100370034003900360045003500360036007d000000</data>
|
|
<asString>{.D.A.6.2.F.0.0.A.-.A.0.5.4.-.4.F.B.2.-.8.F.7.3.-.1.7.1.A.7.4.9.6.E.5.6.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776379</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6f3f53ac-3323-445c-9236-0794fb401551}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440042004300410038003200380035002d0035003400330042002d0034003000330035002d0042003900330035002d004200390039004500320033003100350037003500360031007d000000</data>
|
|
<asString>{.D.B.C.A.8.2.8.5.-.5.4.3.B.-.4.0.3.5.-.B.9.3.5.-.B.9.9.E.2.3.1.5.7.5.6.1.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776380</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{02438bea-ea89-467b-95c8-818ba1d1c792}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300039003200340033003100330033002d0033004400350041002d0034004500340034002d0041003800310041002d003700440030003100330034004300300031003800440030007d000000</data>
|
|
<asString>{.0.9.2.4.3.1.3.3.-.3.D.5.A.-.4.E.4.4.-.A.8.1.A.-.7.D.0.1.3.4.C.0.1.8.D.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776381</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{86b5cc90-9f68-470a-b4ea-a0649192dc04}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00330033003100430046004600440038002d0046003100320041002d0034004200410044002d0041004200410043002d004100410039004100300035003500460041003800370037007d000000</data>
|
|
<asString>{.3.3.1.C.F.F.D.8.-.F.1.2.A.-.4.B.A.D.-.A.B.A.C.-.A.A.9.A.0.5.5.F.A.8.7.7.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776382</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c7e71c4d-4300-492f-9531-78b23a4270af}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00340034003100360030004200370037002d0042003100340043002d0034003100380042002d0041004600420037002d003500350034004200330032003900420034003600310041007d000000</data>
|
|
<asString>{.4.4.1.6.0.B.7.7.-.B.1.4.C.-.4.1.8.B.-.A.F.B.7.-.5.5.4.B.3.2.9.B.4.6.1.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776383</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ba1eb0dc-09b8-4985-9a99-40696b5eb363}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300038004600420044003100370037002d0046003100330033002d0034003500390036002d0042003800380037002d003200430042004600420042003900440044003300420032007d000000</data>
|
|
<asString>{.0.8.F.B.D.1.7.7.-.F.1.3.3.-.4.5.9.6.-.B.8.8.7.-.2.C.B.F.B.B.9.D.D.3.B.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776384</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{bdfe501c-4d70-448d-939f-01ee41bd1d51}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440039004100370033003800330034002d0038004100310037002d0034004400370043002d0042003600460034002d003500330038004300350032003000450033004100440036007d000000</data>
|
|
<asString>{.D.9.A.7.3.8.3.4.-.8.A.1.7.-.4.D.7.C.-.B.6.F.4.-.5.3.8.C.5.2.0.E.3.A.D.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776385</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{84f429fe-9e92-4f64-9e85-1638507af4bb}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430042004300370037003300320035002d0044003300420032002d0034003300350032002d0039004300380043002d004300350034003300330036003800460032003100330030007d000000</data>
|
|
<asString>{.C.B.C.7.7.3.2.5.-.D.3.B.2.-.4.3.5.2.-.9.C.8.C.-.C.5.4.3.3.6.8.F.2.1.3.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776386</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c517f12a-4314-4b91-a3e3-cffa9ba1151c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00360032004300430045004500330042002d0035003800300030002d0034004500430036002d0038003200450041002d003700330035003300330030004400320033004100370041007d000000</data>
|
|
<asString>{.6.2.C.C.E.E.3.B.-.5.8.0.0.-.4.E.C.6.-.8.2.E.A.-.7.3.5.3.3.0.D.2.3.A.7.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776387</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4e4daac0-5ff3-4fd0-b89b-8515c76d2b39}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350035004100360038003800460033002d0037004300410032002d0034004300330038002d0042004600300035002d004200350035004300340042003900390041004500330030007d000000</data>
|
|
<asString>{.5.5.A.6.8.8.F.3.-.7.C.A.2.-.4.C.3.8.-.B.F.0.5.-.B.5.5.C.4.B.9.9.A.E.3.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776388</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2cbac533-c29f-4914-9c3d-39c8c547a017}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440038003800330041003700450039002d0037003600420031002d0034003000350041002d0042003900380034002d003800430033003600360032003200450033004600310036007d000000</data>
|
|
<asString>{.D.8.8.3.A.7.E.9.-.7.6.B.1.-.4.0.5.A.-.B.9.8.4.-.8.C.3.6.6.2.2.E.3.F.1.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776389</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{b09b0efc-578d-48b1-ab44-ad43ae7e0180}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300042004200300036003800340038002d0031004100450035002d0034004600310041002d0042003100310041002d004500380030003600360035003900420041003900370037007d000000</data>
|
|
<asString>{.0.B.B.0.6.8.4.8.-.1.A.E.5.-.4.F.1.A.-.B.1.1.A.-.E.8.0.6.6.5.9.B.A.9.7.7.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776390</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{df4b6bcf-364f-4b59-be2e-708a2cf34736}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440032003200380042003800430043002d0037003700320043002d0034003000420046002d0041004100460046002d003700370042003600360031003500450039003300310033007d000000</data>
|
|
<asString>{.D.2.2.8.B.8.C.C.-.7.7.2.C.-.4.0.B.F.-.A.A.F.F.-.7.7.B.6.6.1.5.E.9.3.1.3.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776391</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f1e8ead7-7365-4b62-98e0-07d8c7a70f69}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440032003400340033003300320041002d0038003100320044002d0034004600350045002d0039004300390045002d004400330035004500300032003100300044003900450034007d000000</data>
|
|
<asString>{.D.2.4.4.3.3.2.A.-.8.1.2.D.-.4.F.5.E.-.9.C.9.E.-.D.3.5.E.0.2.1.0.D.9.E.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776392</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{54c215ee-3737-4395-b870-3c39a92d6e14}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00380034003900460036003100310038002d0037003000430038002d0034003100370036002d0039004300450033002d004100390037003600320042004100300034003500460034007d000000</data>
|
|
<asString>{.8.4.9.F.6.1.1.8.-.7.0.C.8.-.4.1.7.6.-.9.C.E.3.-.A.9.7.6.2.B.A.0.4.5.F.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776393</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{dc9e7dac-335e-4ac9-86c7-4ec827dfa623}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00360039003000390044004400360038002d0030004200390034002d0034003400330038002d0042003200450034002d003000450043003000450043003500340039004400430035007d000000</data>
|
|
<asString>{.6.9.0.9.D.D.6.8.-.0.B.9.4.-.4.4.3.8.-.B.2.E.4.-.0.E.C.0.E.C.5.4.9.D.C.5.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776394</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e34c6afe-4306-4659-93f3-4d97ec7172c6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00410046004500320030003100380033002d0035003900310031002d0034003900380042002d0038004200320030002d003500420031004100440032003400430044003200330031007d000000</data>
|
|
<asString>{.A.F.E.2.0.1.8.3.-.5.9.1.1.-.4.9.8.B.-.8.B.2.0.-.5.B.1.A.D.2.4.C.D.2.3.1.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776395</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f2910211-63cc-46f9-b8e7-cd75d195b804}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00330038004300450046003000410033002d0039004100310032002d0034004400310042002d0042003400430046002d003200460043003300330041003500350031003500380046007d000000</data>
|
|
<asString>{.3.8.C.E.F.0.A.3.-.9.A.1.2.-.4.D.1.B.-.B.4.C.F.-.2.F.C.3.3.A.5.5.1.5.8.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776396</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{34d3c4b0-f3dd-408d-8f06-aef15eb33e99}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300039003000310043004600320035002d0031003600430030002d0034004200360034002d0039003000390032002d003000390039003400370034004300350044003000450042007d000000</data>
|
|
<asString>{.0.9.0.1.C.F.2.5.-.1.6.C.0.-.4.B.6.4.-.9.0.9.2.-.0.9.9.4.7.4.C.5.D.0.E.B.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776397</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6256af2d-05dd-4bbd-81b0-b65cf3505cc7}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350035003600300039003000390031002d0033004600350043002d0034003500410031002d0041004600420038002d004500340032003300460046003700350043004200300035007d000000</data>
|
|
<asString>{.5.5.6.0.9.0.9.1.-.3.F.5.C.-.4.5.A.1.-.A.F.B.8.-.E.4.2.3.F.F.7.5.C.B.0.5.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776398</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{b656da4a-de0d-4d0e-8f93-4273211ec8de}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300032004400390038003000390036002d0039004100380031002d0034004600370034002d0042003900310046002d004600300042004400450030004400430034003100460041007d000000</data>
|
|
<asString>{.0.2.D.9.8.0.9.6.-.9.A.8.1.-.4.F.7.4.-.B.9.1.F.-.F.0.B.D.E.0.D.C.4.1.F.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776399</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{db9854c8-9f5a-4731-a881-ac02fa59715d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00360032003500460030003500450038002d0045003000360046002d0034003500460035002d0042003300380036002d003700330044003000430043003500320034004100440041007d000000</data>
|
|
<asString>{.6.2.5.F.0.5.E.8.-.E.0.6.F.-.4.5.F.5.-.B.3.8.6.-.7.3.D.0.C.C.5.2.4.A.D.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776400</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{278afac0-96f3-483f-b065-daf09e88e006}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00380030003000460046003400330045002d0035004400320030002d0034004100320034002d0041003600450045002d003000450033004200320035003600320038003600310030007d000000</data>
|
|
<asString>{.8.0.0.F.F.4.3.E.-.5.D.2.0.-.4.A.2.4.-.A.6.E.E.-.0.E.3.B.2.5.6.2.8.6.1.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776401</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{83ff194c-2394-4712-bf17-d5ec5c46f605}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300032003100390031003700360042002d0037004300340030002d0034003400320043002d0042003000370033002d003400450045003600450042004300300032004100300043007d000000</data>
|
|
<asString>{.0.2.1.9.1.7.6.B.-.7.C.4.0.-.4.4.2.C.-.B.0.7.3.-.4.E.E.6.E.B.C.0.2.A.0.C.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776402</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d44012ee-bfc1-40ec-8efe-d82a7572b0f4}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00410037004100310046003400340031002d0030003800360031002d0034003500320036002d0041004300310039002d004300300045004600410039003100330033003300430034007d000000</data>
|
|
<asString>{.A.7.A.1.F.4.4.1.-.0.8.6.1.-.4.5.2.6.-.A.C.1.9.-.C.0.E.F.A.9.1.3.3.3.C.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776403</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6cc13dd8-dd41-4153-9f2c-b73d772dbef3}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300030003600360030003200300039002d0039003000340039002d0034004300450033002d0038003100450030002d004200320039004300300031004400310035003900460043007d000000</data>
|
|
<asString>{.0.0.6.6.0.2.0.9.-.9.0.4.9.-.4.C.E.3.-.8.1.E.0.-.B.2.9.C.0.1.D.1.5.9.F.C.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776404</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ff24c069-f535-479a-8c11-f081dd0ac319}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320033003600450033003900320033002d0039003200320032002d0034003000330035002d0038003500410046002d003100390031003100410035004200380042003900340035007d000000</data>
|
|
<asString>{.2.3.6.E.3.9.2.3.-.9.2.2.2.-.4.0.3.5.-.8.5.A.F.-.1.9.1.1.A.5.B.8.B.9.4.5.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776405</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4d5c2e53-a292-49ca-a085-a5576bb43cbf}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310031004600430030003200420045002d0030004100410037002d0034003300330043002d0041003700430033002d004500310046004100360037004200340046004300410034007d000000</data>
|
|
<asString>{.1.1.F.C.0.2.B.E.-.0.A.A.7.-.4.3.3.C.-.A.7.C.3.-.E.1.F.A.6.7.B.4.F.C.A.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776406</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{10fff4e2-b1f1-4ad9-8621-d8312897f70d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370035003500380031004100380039002d0030003600300032002d0034004300380044002d0038003000310030002d003600440044003300340036003100440035003500330045007d000000</data>
|
|
<asString>{.7.5.5.8.1.A.8.9.-.0.6.0.2.-.4.C.8.D.-.8.0.1.0.-.6.D.D.3.4.6.1.D.5.5.3.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776407</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{368c1f37-db34-4e36-ae3e-1a894777a379}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440043004600330045003900310032002d0036003600390035002d0034004100430039002d0038004100430039002d003700390033003300340038003200430039003400330037007d000000</data>
|
|
<asString>{.D.C.F.3.E.9.1.2.-.6.6.9.5.-.4.A.C.9.-.8.A.C.9.-.7.9.3.3.4.8.2.C.9.4.3.7.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776408</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{488dae1d-fa1e-404f-a365-32b5f9a97209}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430033003600420031003000370036002d0034003700450043002d0034004200450045002d0039003500300037002d004500300035004500330041003400360036004300340045007d000000</data>
|
|
<asString>{.C.3.6.B.1.0.7.6.-.4.7.E.C.-.4.B.E.E.-.9.5.0.7.-.E.0.5.E.3.A.4.6.6.C.4.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776411</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6f8faa8d-e741-4380-a25e-079570bee209}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430038003300330037003200310044002d0039003500300034002d0034004400310041002d0039003900340042002d004500360036003300380043004200320041003500370045007d000000</data>
|
|
<asString>{.C.8.3.3.7.2.1.D.-.9.5.0.4.-.4.D.1.A.-.9.9.4.B.-.E.6.6.3.8.C.B.2.A.5.7.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776412</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{7252f45c-99e4-4b10-a885-6e89864ddbdf}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440030004400460045003600420034002d0037003700350042002d0034003200360037002d0041003300340035002d003700390033004300440034003300340043003900410041007d000000</data>
|
|
<asString>{.D.0.D.F.E.6.B.4.-.7.7.5.B.-.4.2.6.7.-.A.3.4.5.-.7.9.3.C.D.4.3.4.C.9.A.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776413</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{cc263db7-a803-4ddc-915b-c28786aa1106}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430042003200430043004500370033002d0033003300380045002d0034003400410045002d0038003600350044002d003100370039003400420041004100460039003300430044007d000000</data>
|
|
<asString>{.C.B.2.C.C.E.7.3.-.3.3.8.E.-.4.4.A.E.-.8.6.5.D.-.1.7.9.4.B.A.A.F.9.3.C.D.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776414</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{41d435c4-374c-4379-81c5-e77b5ac3b000}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00340034004500450037003200430034002d0032003300450035002d0034004100340030002d0042003900340033002d003900310044004300450036003000310043003600420045007d000000</data>
|
|
<asString>{.4.4.E.E.7.2.C.4.-.2.3.E.5.-.4.A.4.0.-.B.9.4.3.-.9.1.D.C.E.6.0.1.C.6.B.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776415</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{61b04769-24ce-41d7-a0db-551604ba286c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300046003800460043003500310032002d0038003100410034002d0034003600410038002d0039003300390036002d004400440041004500420036004300350046004200370034007d000000</data>
|
|
<asString>{.0.F.8.F.C.5.1.2.-.8.1.A.4.-.4.6.A.8.-.9.3.9.6.-.D.D.A.E.B.6.C.5.F.B.7.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776416</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ea99112d-7c47-468c-97a2-0f8d8b8d9434}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00420038004300450030003900440031002d0044003800390033002d0034003200340042002d0039003500370045002d003900360030004600350035004400460036003400370041007d000000</data>
|
|
<asString>{.B.8.C.E.0.9.D.1.-.D.8.9.3.-.4.2.4.B.-.9.5.7.E.-.9.6.0.F.5.5.D.F.6.4.7.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776417</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{cce03e11-69e7-4526-b635-6c4d3d4d9e60}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320045003000320042003700450034002d0034004300320038002d0034004300460045002d0038003000360036002d003600350039003800440046003400410039003700300041007d000000</data>
|
|
<asString>{.2.E.0.2.B.7.E.4.-.4.C.2.8.-.4.C.F.E.-.8.0.6.6.-.6.5.9.8.D.F.4.A.9.7.0.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776418</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{9e93f20a-fa57-4f9e-a74e-b92fb120b2cd}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350035003100350042004500420044002d0031003600430043002d0034003800420037002d0042003500430044002d003000440036003200320038003900360035004300380032007d000000</data>
|
|
<asString>{.5.5.1.5.B.E.B.D.-.1.6.C.C.-.4.8.B.7.-.B.5.C.D.-.0.D.6.2.2.8.9.6.5.C.8.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776419</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d7494c94-88e8-4e5e-9a7a-b5ceda82fff6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430034003600380031003400350034002d0036004200330038002d0034003700360037002d0038003500440045002d004600340037004400420039004500310046004600310039007d000000</data>
|
|
<asString>{.C.4.6.8.1.4.5.4.-.6.B.3.8.-.4.7.6.7.-.8.5.D.E.-.F.4.7.D.B.9.E.1.F.F.1.9.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776420</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{39b3a2c0-9c09-4442-b2f2-43214a54b45a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450035004600460033003900460030002d0045004100370032002d0034003300440031002d0042004100410044002d003500390031003700330039004300330043003300380039007d000000</data>
|
|
<asString>{.E.5.F.F.3.9.F.0.-.E.A.7.2.-.4.3.D.1.-.B.A.A.D.-.5.9.1.7.3.9.C.3.C.3.8.9.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776421</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{2baa143c-6dbe-49e8-9267-5cc0059ed12d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350044004600460036004500300030002d0044003800310041002d0034004300460035002d0041003300410034002d003800320045003600360033003600380036004100360041007d000000</data>
|
|
<asString>{.5.D.F.F.6.E.0.0.-.D.8.1.A.-.4.C.F.5.-.A.3.A.4.-.8.2.E.6.6.3.6.8.6.A.6.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776422</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{26af65c1-8005-4cf0-ada0-9aa571a1365e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00380035003200380031004100330031002d0034004100420033002d0034003100310032002d0039004100390037002d004300430038003700390045003900430044003500440039007d000000</data>
|
|
<asString>{.8.5.2.8.1.A.3.1.-.4.A.B.3.-.4.1.1.2.-.9.A.9.7.-.C.C.8.7.9.E.9.C.D.5.D.9.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776423</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ea23c737-f8b8-4a7d-ab55-3396e8d029f2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440043003500430044003200380046002d0039004300350044002d0034004300300042002d0041003100370043002d003100300045003800390030004200450037004100390043007d000000</data>
|
|
<asString>{.D.C.5.C.D.2.8.F.-.9.C.5.D.-.4.C.0.B.-.A.1.7.C.-.1.0.E.8.9.0.B.E.7.A.9.C.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776424</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{bff5e1d1-5465-49b3-b3c6-c812334ae432}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370039004200450034003500330045002d0031003300340031002d0034004200320045002d0039003000460031002d004300370044003300300033003500350038003900450041007d000000</data>
|
|
<asString>{.7.9.B.E.4.5.3.E.-.1.3.4.1.-.4.B.2.E.-.9.0.F.1.-.C.7.D.3.0.3.5.5.8.9.E.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776425</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a7a81b7f-2287-4d4a-b34e-eafa46a56fed}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00410036004200430039004300340030002d0034003400390041002d0034003100340043002d0038003200310038002d003700390042004100330044004200410038003000390043007d000000</data>
|
|
<asString>{.A.6.B.C.9.C.4.0.-.4.4.9.A.-.4.1.4.C.-.8.2.1.8.-.7.9.B.A.3.D.B.A.8.0.9.C.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776426</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{0dfc39e6-df49-4ff4-ad33-a67704cd209b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00410041003400310039004300440038002d0033003800440030002d0034003800390036002d0039004200350030002d003100350046003600300037003700440032003600370032007d000000</data>
|
|
<asString>{.A.A.4.1.9.C.D.8.-.3.8.D.0.-.4.8.9.6.-.9.B.5.0.-.1.5.F.6.0.7.7.D.2.6.7.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776427</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e014bc02-d4a9-413d-8213-199172a7df9e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00330043003900350045003100460041002d0046004400370038002d0034004400320042002d0038004200430041002d003000420045004400420038004500460035003300350034007d000000</data>
|
|
<asString>{.3.C.9.5.E.1.F.A.-.F.D.7.8.-.4.D.2.B.-.8.B.C.A.-.0.B.E.D.B.8.E.F.5.3.5.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776428</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{21f5906e-61ef-4d15-87b2-89f4786ec5d0}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300036003800450035004300340033002d0042003800390042002d0034003200350041002d0039003700430039002d003300310036003100390041003300410038004400440030007d000000</data>
|
|
<asString>{.0.6.8.E.5.C.4.3.-.B.8.9.B.-.4.2.5.A.-.9.7.C.9.-.3.1.6.1.9.A.3.A.8.D.D.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776429</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a6088cfc-cd47-4787-b825-f9182c0e5bfe}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00380044003000430035004600310043002d0033003400440032002d0034003700450046002d0042004200340043002d003500330043004400350046003000300031003900310045007d000000</data>
|
|
<asString>{.8.D.0.C.5.F.1.C.-.3.4.D.2.-.4.7.E.F.-.B.B.4.C.-.5.3.C.D.5.F.0.0.1.9.1.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776430</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{816e87d6-82f6-4a64-8f51-5ce17e19ce41}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350042003000460030004500440045002d0031003000430046002d0034003900440036002d0041003300440033002d003800360036004300320031003800420038003400300046007d000000</data>
|
|
<asString>{.5.B.0.F.0.E.D.E.-.1.0.C.F.-.4.9.D.6.-.A.3.D.3.-.8.6.6.C.2.1.8.B.8.4.0.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776431</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ddb485c7-523d-473e-aa7c-006050a20609}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00460039003000410039003400460044002d0038003700390045002d0034004100380035002d0041003200300036002d004400320037004600360034003000330039003200350038007d000000</data>
|
|
<asString>{.F.9.0.A.9.4.F.D.-.8.7.9.E.-.4.A.8.5.-.A.2.0.6.-.D.2.7.F.6.4.0.3.9.2.5.8.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776432</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{aab2b3fd-6d4d-4a30-8f5d-4562010bd49e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00420032003800410046003000450035002d0044003000420037002d0034003800420036002d0039004500300030002d003300430031003100320030004600430043004300460034007d000000</data>
|
|
<asString>{.B.2.8.A.F.0.E.5.-.D.0.B.7.-.4.8.B.6.-.9.E.0.0.-.3.C.1.1.2.0.F.C.C.C.F.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776433</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{5f3612b3-d154-4a81-a87f-9812b69d879f}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320034003100380043004400430037002d0033003100410036002d0034003400310044002d0038004500390034002d003200430030003800310033003300430034003500340041007d000000</data>
|
|
<asString>{.2.4.1.8.C.D.C.7.-.3.1.A.6.-.4.4.1.D.-.8.E.9.4.-.2.C.0.8.1.3.3.C.4.5.4.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776434</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{abb7f935-dc63-46d8-b66c-f0cc5c1e5280}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00390033004200440033004100370031002d0031003000320036002d0034003600450031002d0041004100320032002d003700360030004100460035003500430038004200320034007d000000</data>
|
|
<asString>{.9.3.B.D.3.A.7.1.-.1.0.2.6.-.4.6.E.1.-.A.A.2.2.-.7.6.0.A.F.5.5.C.8.B.2.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776435</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{54883c72-078c-4ac9-ba34-a84418454eca}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310046003100300039004300340033002d0035003900310038002d0034004600460043002d0039003600410030002d004600310039003900450033003500420043003200410032007d000000</data>
|
|
<asString>{.1.F.1.0.9.C.4.3.-.5.9.1.8.-.4.F.F.C.-.9.6.A.0.-.F.1.9.9.E.3.5.B.C.2.A.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776436</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{70e256b2-922a-432a-9f93-0da28403e285}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310037004200340039003100450032002d0042004600310034002d0034004100380033002d0042003300450037002d004300390039004200390044003700390039003800340036007d000000</data>
|
|
<asString>{.1.7.B.4.9.1.E.2.-.B.F.1.4.-.4.A.8.3.-.B.3.E.7.-.C.9.9.B.9.D.7.9.9.8.4.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776439</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{768024ef-bdcf-4652-87ba-6bab3d4c5188}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450039004500420045003000310038002d0041003000300034002d0034004100320030002d0039003400450036002d003500350036004600450030003400440038003600340044007d000000</data>
|
|
<asString>{.E.9.E.B.E.0.1.8.-.A.0.0.4.-.4.A.2.0.-.9.4.E.6.-.5.5.6.F.E.0.4.D.8.6.4.D.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776440</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3b994b2a-f242-4c76-855c-03b815f2060b}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450038003900360042003900450042002d0037003900420041002d0034003700430043002d0039003000390045002d003800410038003900420039004200370044003200370037007d000000</data>
|
|
<asString>{.E.8.9.6.B.9.E.B.-.7.9.B.A.-.4.7.C.C.-.9.0.9.E.-.8.A.8.9.B.9.B.7.D.2.7.7.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776441</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6df8b345-0230-43d9-8d8e-12dc278a5da6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300034003300330035004500380033002d0036004400330044002d0034003400380039002d0041003800420044002d003400360031004500300031003200390046004300450036007d000000</data>
|
|
<asString>{.0.4.3.3.5.E.8.3.-.6.D.3.D.-.4.4.8.9.-.A.8.B.D.-.4.6.1.E.0.1.2.9.F.C.E.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776442</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f24769c1-3640-4f68-afde-76aa79179219}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00340031004100320034003700320045002d0046004600440036002d0034003600450032002d0041003000330035002d004300430038004600450031003000300034004500410038007d000000</data>
|
|
<asString>{.4.1.A.2.4.7.2.E.-.F.F.D.6.-.4.6.E.2.-.A.0.3.5.-.C.C.8.F.E.1.0.0.4.E.A.8.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776443</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{aefe901c-5a83-4e4c-9d5e-178ff2082943}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00380046003100310042003900390034002d0044003100390031002d0034003000340038002d0042003900430042002d003000460044003500380045003600330030003600390036007d000000</data>
|
|
<asString>{.8.F.1.1.B.9.9.4.-.D.1.9.1.-.4.0.4.8.-.B.9.C.B.-.0.F.D.5.8.E.6.3.0.6.9.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776444</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{78518afb-c587-4564-a904-4e6be35bf900}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00390044003400440034004500370032002d0038004600350044002d0034003000340041002d0039003400380036002d003400420035003400320039004600460035003800330031007d000000</data>
|
|
<asString>{.9.D.4.D.4.E.7.2.-.8.F.5.D.-.4.0.4.A.-.9.4.8.6.-.4.B.5.4.2.9.F.F.5.8.3.1.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776445</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{95555d1b-c7d8-4915-b994-00260f75e514}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310038003400440030003600440041002d0044003100370037002d0034004600450045002d0041004300460032002d003900350042003700380032004100420035003900390046007d000000</data>
|
|
<asString>{.1.8.4.D.0.6.D.A.-.D.1.7.7.-.4.F.E.E.-.A.C.F.2.-.9.5.B.7.8.2.A.B.5.9.9.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776446</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{0b587fb8-2b5d-4186-84ca-ff54e76304fa}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00340046003200340043004200390039002d0034003900430038002d0034004300340036002d0038003200350042002d004400370031004100390037003800360043004200440034007d000000</data>
|
|
<asString>{.4.F.2.4.C.B.9.9.-.4.9.C.8.-.4.C.4.6.-.8.2.5.B.-.D.7.1.A.9.7.8.6.C.B.D.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776447</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{805b81fa-6d7a-43a3-91c1-f13f1a1a9162}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450034004500380046003900330036002d0043004600380036002d0034003200410036002d0039003900450031002d003400370045004200390033003400380042003700420030007d000000</data>
|
|
<asString>{.E.4.E.8.F.9.3.6.-.C.F.8.6.-.4.2.A.6.-.9.9.E.1.-.4.7.E.B.9.3.4.8.B.7.B.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776448</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{4069af0d-2fc4-448f-807f-9c6876d0a3ea}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00390041003500440033003800450041002d0046003300350043002d0034003100380043002d0041003700310033002d003300340044003000360031004500360033003500420046007d000000</data>
|
|
<asString>{.9.A.5.D.3.8.E.A.-.F.3.5.C.-.4.1.8.C.-.A.7.1.3.-.3.4.D.0.6.1.E.6.3.5.B.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776449</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{a5bfc811-4153-4f33-8718-d8f4522e2091}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00390038003700360044003800450035002d0046003300310035002d0034004500460043002d0039004500440043002d003800420039003300410046003100360031004300330045007d000000</data>
|
|
<asString>{.9.8.7.6.D.8.E.5.-.F.3.1.5.-.4.E.F.C.-.9.E.D.C.-.8.B.9.3.A.F.1.6.1.C.3.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776450</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{1a89d52d-bdc9-4413-bd14-8e6e834da99c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00350041003900440046004100340039002d0039004100350030002d0034003400450036002d0038004400460046002d004100460039003500450032004500430038004400390032007d000000</data>
|
|
<asString>{.5.A.9.D.F.A.4.9.-.9.A.5.0.-.4.4.E.6.-.8.D.F.F.-.A.F.9.5.E.2.E.C.8.D.9.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776451</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{804b6c1e-62a6-440e-a4e1-45fd8949dce6}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430043004100300043003400320032002d0037003400310041002d0034004500350044002d0038004100300045002d003300360038003700350041004300440036003100420038007d000000</data>
|
|
<asString>{.C.C.A.0.C.4.2.2.-.7.4.1.A.-.4.E.5.D.-.8.A.0.E.-.3.6.8.7.5.A.C.D.6.1.B.8.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776452</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c99679ae-a6f8-497d-b6eb-94821d27a44d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440038004600430033003500310035002d0043003200360037002d0034003700420042002d0039003700430045002d003900330032003000300035003800300043003600330045007d000000</data>
|
|
<asString>{.D.8.F.C.3.5.1.5.-.C.2.6.7.-.4.7.B.B.-.9.7.C.E.-.9.3.2.0.0.5.8.0.C.6.3.E.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776453</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{221b7254-8807-42ab-bfa5-0cd2dbd0f0d5}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440046003100340037003300440037002d0030003800330033002d0034003500300042002d0039003900310041002d003100420039003800380044003300300038004400360039007d000000</data>
|
|
<asString>{.D.F.1.4.7.3.D.7.-.0.8.3.3.-.4.5.0.B.-.9.9.1.A.-.1.B.9.8.8.D.3.0.8.D.6.9.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776454</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{0f24b893-b964-4d88-8875-d462390251e5}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450038003900360034004100340044002d0045003800380046002d0034003400330043002d0042003600360046002d004300420037003000450039003700410036004200380038007d000000</data>
|
|
<asString>{.E.8.9.6.4.A.4.D.-.E.8.8.F.-.4.4.3.C.-.B.6.6.F.-.C.B.7.0.E.9.7.A.6.B.8.8.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776455</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c8e8b63f-05ac-4b2c-858a-d3b66b9bca94}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300038003400420039004500320036002d0046003900320046002d0034003100350039002d0042003700370043002d003000460046003900410032003600360046004400390041007d000000</data>
|
|
<asString>{.0.8.4.B.9.E.2.6.-.F.9.2.F.-.4.1.5.9.-.B.7.7.C.-.0.F.F.9.A.2.6.6.F.D.9.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776456</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{934834f5-e0a5-441b-85c2-73fd9be9463f}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370045004600430031003900320033002d0038003000460042002d0034003900440046002d0042003000430033002d004100350033004400430038003800450033004300430030007d000000</data>
|
|
<asString>{.7.E.F.C.1.9.2.3.-.8.0.F.B.-.4.9.D.F.-.B.0.C.3.-.A.5.3.D.C.8.8.E.3.C.C.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776457</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f0e85dc1-2a2a-4fc0-b501-a30cbac74a8e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450044004200330043004400310045002d0042004600370041002d0034003500440036002d0041003800390034002d003300340046003300360039003400370034003400380041007d000000</data>
|
|
<asString>{.E.D.B.3.C.D.1.E.-.B.F.7.A.-.4.5.D.6.-.A.8.9.4.-.3.4.F.3.6.9.4.7.4.4.8.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776458</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{09a98b8a-115e-495c-836b-42b475630183}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00450030004400420042004100410031002d0043004200330035002d0034003100450037002d0039003900350043002d003300370041004200360043003500380035003400300038007d000000</data>
|
|
<asString>{.E.0.D.B.B.A.A.1.-.C.B.3.5.-.4.1.E.7.-.9.9.5.C.-.3.7.A.B.6.C.5.8.5.4.0.8.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776461</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{400124d1-e3bc-4c21-84f1-9c2fdd660eaa}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00390031003000440039003100450031002d0032003900320038002d0034003600420032002d0038003600450046002d003600410045003100460032004400380045003200410043007d000000</data>
|
|
<asString>{.9.1.0.D.9.1.E.1.-.2.9.2.8.-.4.6.B.2.-.8.6.E.F.-.6.A.E.1.F.2.D.8.E.2.A.C.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776462</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{f9f5ba6c-d936-4b6f-9503-aa2fc28d2bb8}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440046004400410045004600310031002d0046004100420043002d0034003400460031002d0039003400450036002d003300440043003600320035003800460038003500420036007d000000</data>
|
|
<asString>{.D.F.D.A.E.F.1.1.-.F.A.B.C.-.4.4.F.1.-.9.4.E.6.-.3.D.C.6.2.5.8.F.8.5.B.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776463</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{fbb9b711-0218-4bd3-bc24-5f88cdd9fcec}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310034003400450038003900370032002d0030004500310030002d0034003600350033002d0038004400440032002d003600420031003400350038003000440046004600300046007d000000</data>
|
|
<asString>{.1.4.4.E.8.9.7.2.-.0.E.1.0.-.4.6.5.3.-.8.D.D.2.-.6.B.1.4.5.8.0.D.F.F.0.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776464</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{60847319-40c2-4c6b-9b63-67b1fdef219d}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00300043003000420030003500410046002d0046003100450043002d0034003000310039002d0038004400340032002d004300350034004400350044004400340031004500420041007d000000</data>
|
|
<asString>{.0.C.0.B.0.5.A.F.-.F.1.E.C.-.4.0.1.9.-.8.D.4.2.-.C.5.4.D.5.D.D.4.1.E.B.A.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776467</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6b9eebdb-a4d1-451c-9830-de157ab09a0a}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00430045004300380041003000420044002d0042004500320041002d0034003900440034002d0038004200310044002d004400440032003900340035004300440039003300440046007d000000</data>
|
|
<asString>{.C.E.C.8.A.0.B.D.-.B.E.2.A.-.4.9.D.4.-.8.B.1.D.-.D.D.2.9.4.5.C.D.9.3.D.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776468</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3e440dea-e76d-48aa-b372-560e409b30f1}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000</data>
|
|
<asString>I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776481</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{9d6ea685-ea31-45e1-b8da-a022482c5663}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000</data>
|
|
<asString>I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776482</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e6cbde25-ce3a-4f6c-ad20-2430fc3be2ec}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000</data>
|
|
<asString>I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776483</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d67aa0d4-e024-4a5e-b849-9b0a4411f2c7}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000</data>
|
|
<asString>I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776484</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{e7d69b11-d4ea-4140-afc1-3bd5e7bc77d3}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000</data>
|
|
<asString>I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776485</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d4108881-9c33-48bd-9ba2-da4340a6d656}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>49005000730065006300200041006400640072006500730073002000490073006f006c006100740069006f006e00200066006f0072002000530065006300750072006500200043006f006e005300650063002000520075006c00650073000000</data>
|
|
<asString>I.P.s.e.c. .A.d.d.r.e.s.s. .I.s.o.l.a.t.i.o.n. .f.o.r. .S.e.c.u.r.e. .C.o.n.S.e.c. .R.u.l.e.s...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776486</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{321945bf-7e0d-4d0b-ba60-4c35526d1059}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00370034003000390038003700450033002d0038004200460039002d0034003000330033002d0038004400330032002d004200440030003200340036003900430035003500360032007d000000</data>
|
|
<asString>{.7.4.0.9.8.7.E.3.-.8.B.F.9.-.4.0.3.3.-.8.D.3.2.-.B.D.0.2.4.6.9.C.5.5.6.2.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776489</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{fd7430b7-c11f-4981-beb4-57061db06e47}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310033004400310037003200340045002d0043003100300041002d0034004200360044002d0042003000300039002d003900370033004600320032003600440043004400340046007d000000</data>
|
|
<asString>{.1.3.D.1.7.2.4.E.-.C.1.0.A.-.4.B.6.D.-.B.0.0.9.-.9.7.3.F.2.2.6.D.C.D.4.F.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776490</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{3576462a-269e-4a46-9f90-72d5b7c9c10e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006800690065006c006400650064002000490043004d00500020007600340020004f00750074000000</data>
|
|
<asString>S.h.i.e.l.d.e.d. .I.C.M.P. .v.4. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776491</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{5848fa86-7a5a-4193-9e0b-e6a3e69395f8}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006800690065006c006400650064002000490043004d00500020007600360020004f00750074000000</data>
|
|
<asString>S.h.i.e.l.d.e.d. .I.C.M.P. .v.6. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776492</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{8ab03769-319b-4d2e-81dd-8edc91cbbb8c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006800690065006c006400650064002000490043004d00500020007600340020004f00750074000000</data>
|
|
<asString>S.h.i.e.l.d.e.d. .I.C.M.P. .v.4. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776493</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{302e8ae9-db45-4f11-bf3d-20e0807f3804}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006800690065006c006400650064002000490043004d00500020007600360020004f00750074000000</data>
|
|
<asString>S.h.i.e.l.d.e.d. .I.C.M.P. .v.6. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776494</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{aa4a4221-6f16-4b9c-9a07-b4b4ba6a6bf2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006800690065006c006400650064002000490043004d00500020007600340020004f00750074000000</data>
|
|
<asString>S.h.i.e.l.d.e.d. .I.C.M.P. .v.4. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776495</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{11a26e34-bc51-40d3-b421-822ad6efbb3e}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>53006800690065006c006400650064002000490043004d00500020007600360020004f00750074000000</data>
|
|
<asString>S.h.i.e.l.d.e.d. .I.C.M.P. .v.6. .O.u.t...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776496</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{7b4bd8fd-5d1f-4b8c-9836-4a01a350e746}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00320033004300340039003900450031002d0043003700360042002d0034003700300035002d0041003700310031002d004400450041004400360032004300380033003800440033007d000000</data>
|
|
<asString>{.2.3.C.4.9.9.E.1.-.C.7.6.B.-.4.7.0.5.-.A.7.1.1.-.D.E.A.D.6.2.C.8.3.8.D.3.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776497</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ab88322b-f465-4441-9345-715826fcab31}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00420045003800300036004300350034002d0041003800410046002d0034003200330043002d0039004500350036002d004300350041003800300033004600450041003300310033007d000000</data>
|
|
<asString>{.B.E.8.0.6.C.5.4.-.A.8.A.F.-.4.2.3.C.-.9.E.5.6.-.C.5.A.8.0.3.F.E.A.3.1.3.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776498</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{d6011340-9eba-4253-9ed0-a763c7ef7b6c}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00310042004100420031003400360035002d0034003000430045002d0034003500390039002d0039004500420032002d003200340035003600440030004600420041003300330043007d000000</data>
|
|
<asString>{.1.B.A.B.1.4.6.5.-.4.0.C.E.-.4.5.9.9.-.9.E.B.2.-.2.4.5.6.D.0.F.B.A.3.3.C.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776499</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{6186f5b6-f4b7-414d-ba20-a82103204847}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00440031003000440041003000340039002d0041004500340035002d0034003200370032002d0039003900450032002d004600370046003800350035003200450046003700420030007d000000</data>
|
|
<asString>{.D.1.0.D.A.0.4.9.-.A.E.4.5.-.4.2.7.2.-.9.9.E.2.-.F.7.F.8.5.5.2.E.F.7.B.0.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776500</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{c4f20cf5-f405-49a7-b6a4-97b66f9cf587}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00420041004500420032003100440043002d0039003100330043002d0034004100300037002d0039004400440042002d004400320034003400360041003400390041003200360036007d000000</data>
|
|
<asString>{.B.A.E.B.2.1.D.C.-.9.1.3.C.-.4.A.0.7.-.9.D.D.B.-.D.2.4.4.6.A.4.9.A.2.6.6.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776501</providerContextId>
|
|
</item>
|
|
<item>
|
|
<providerContextKey>{ba22195c-728b-4815-be61-4a4f69743fe2}</providerContextKey>
|
|
<displayData>
|
|
<name>MPSSVC</name>
|
|
<description>Stores filter origin</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<type>FWPM_GENERAL_CONTEXT</type>
|
|
<dataBuffer>
|
|
<data>7b00330030003600350032004100450030002d0035003300320031002d0034003200390033002d0041004100430042002d003200440045003300300042004500360033003600340034007d000000</data>
|
|
<asString>{.3.0.6.5.2.A.E.0.-.5.3.2.1.-.4.2.9.3.-.A.A.C.B.-.2.D.E.3.0.B.E.6.3.6.4.4.}...</asString>
|
|
</dataBuffer>
|
|
<providerContextId>9223372036854776502</providerContextId>
|
|
</item>
|
|
</providerContexts>
|
|
<subLayers numItems="22">
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_INSPECTION</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in Inspection Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>0</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_TEREDO</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in Edge Traversal Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>1</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WF</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in MPSSVC Windows Firewall Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WF</providerKey>
|
|
<providerData/>
|
|
<weight>2</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_WSH</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in MPSSVC Windows Service Hardening Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData/>
|
|
<weight>3</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_QUARANTINE</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in MPSSVC Quarantine Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_WSH</providerKey>
|
|
<providerData/>
|
|
<weight>4</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_EDP</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in MPSSVC Enterprise Data Protection Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_EDP</providerKey>
|
|
<providerData/>
|
|
<weight>5</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_TENANT_RESTRICTIONS</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in MPSSVC Tenant Restrictions Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_TENANT_RESTRICTIONS</providerKey>
|
|
<providerData/>
|
|
<weight>6</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_MPSSVC_APP_ISOLATION</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in MPSSVC App Isolation Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey>FWPM_PROVIDER_MPSSVC_APP_ISOLATION</providerKey>
|
|
<providerData/>
|
|
<weight>7</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>{7b6b11f6-cbb5-433c-ae06-6a4f0076e49e}</subLayerKey>
|
|
<displayData>
|
|
<name>Edge traversal Teredo Authorization Sublayer</name>
|
|
<description>Edge traversal Teredo Authorization Sublayer</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>8</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
|
|
<displayData>
|
|
<name>windefend</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>4096</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_TCP_CHIMNEY_OFFLOAD</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Chimney Offload Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>8192</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_TCP_TEMPLATES</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in TCP Templates Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>8704</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_IPSEC_SECURITY_REALM</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Security Realm Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>12288</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_SECURE_SOCKET</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in Secure Socket Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>16384</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_LIPS</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in Legacy IPsec Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>32767</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_UNIVERSAL</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in Universal Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>32768</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_IPSEC_DOSP</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec DoS Protection Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>34816</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_IPSEC_FORWARD_OUTBOUND_TUNNEL</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Forward Outbound Tunnel Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>36864</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_IPSEC_TUNNEL</subLayerKey>
|
|
<displayData>
|
|
<name>WFP Built-in IPsec Tunnel Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>40960</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>{9ba30013-c84e-47e5-ac6e-1e1aed72fa69}</subLayerKey>
|
|
<displayData>
|
|
<name>Microsoft Corporation</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags numItems="1">
|
|
<item>FWPM_SUBLAYER_FLAG_PERSISTENT</item>
|
|
</flags>
|
|
<providerKey>{1bebc969-61a5-4732-a177-847a0817862a}</providerKey>
|
|
<providerData/>
|
|
<weight>40961</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>FWPM_SUBLAYER_RPC_AUDIT</subLayerKey>
|
|
<displayData>
|
|
<name>RPC Built-in Audit Sublayer</name>
|
|
<description/>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>49152</weight>
|
|
</item>
|
|
<item>
|
|
<subLayerKey>{a87fb472-fc68-4805-8559-c6ae774773e0}</subLayerKey>
|
|
<displayData>
|
|
<name>PortmasterSublayer</name>
|
|
<description>The Portmaster sublayer holds all it's filters.</description>
|
|
</displayData>
|
|
<flags/>
|
|
<providerKey/>
|
|
<providerData/>
|
|
<weight>65535</weight>
|
|
</item>
|
|
</subLayers>
|
|
</wfpstate>`)
|