Windows Firewall did not apply the following rule.

Question

_{Tuesday, September 29, 2009 6:51 AM}

Hi you all

Im using Windows Server 2008 SP2 for which im trying to clean up the EventLog. Now i stuck at the following Warning which keeps poppin into my event log:
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          28.09.2009 12:51:44
Event ID:      4957
Task Category: MPSSVC Rule-Level Policy Change
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      <Servername>
Description:
Windows Firewall did not apply the following rule:

Rule Information:
 ID: CoreNet-Teredo-In
 Name: Core Networking - Teredo (UDP-In)

Error Information:
 Reason: Local Port resolved to an empty set.

Does someone know, what this means? we have a lot of these events with various ID's, Names and Reasons. If this event can be ignored, is there a possibility to disable it?

Thank you very much in advance!
.willcee

All replies (3)

_{Tuesday, September 29, 2009 6:53 AM}

the port/process/protocol is not opened locally, so the filtering does not apply the rule.
don't you have IPv6 disabled?

o.

_{Thursday, January 21, 2010 6:15 PM}

the port/process/protocol is not opened locally, so the filtering does not apply the rule.
don't you have IPv6 disabled?

o.

Do you mean "Do you have IPv6 disabled"?

We're getting this a ton as well... we're running W2K8 SBS - and no... IP6 is NOT disabled (SBS barks real loud if you try and disable it).

Is it ok to disable this rule on the firewall?  I don't exactly understand WHAT it's doing, or not doing.

_{Thursday, January 21, 2010 11:44 PM}

Maybe this: http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4957 will help?

Good luck!

providing business solutions ..... online fax