Ports blocked but firewall is disabled on Server 2003 with EventID 861

i seeing following events multiple executables  indicating firewall blocking executables on 2003 servers, have firewall set off in control panel.  firewall service still started should not blocking understand??

event type: failure audit
event source: security
event category: detailed tracking
event id: 861
date:  8/17/2009
time:  2:20:02 pm
user:  nt authority\system
computer: xxxxxx
description:
the windows firewall has detected application listening incoming traffic.
 
name: -
path: c:\windows\system32\lsass.exe
process identifier: 456
user account: system
user domain: nt authority
service: yes
rpc server: no
ip version: ipv4
ip protocol: udp
port number: 3715
allowed: no
user notified: no

for more information, see , support center @ http://go.microsoft.com/fwlink/events.asp.

event type: failure audit
event source: security
event category: detailed tracking
event id: 861
date:  8/17/2009
time:  2:20:10 pm
user:  xxxxx
computer: xxxx
description:
the windows firewall has detected application listening incoming traffic.
 
name: -
path: c:\program files\ibm\director\bin\twgsrvw.exe
process identifier: 5996
user account: xxxxx
user domain: xxxx
service: yes
rpc server: no
ip version: ipv4
ip protocol: udp
port number: 3719
allowed: no
user notified: no

for more information, see , support center @ http://go.microsoft.com/fwlink/events.asp.

hi,

 

from article below, can find:

http://technet.microsoft.com/en-us/library/cc737845(ws.10).aspx#bkmk_log

 

security log entries

windows firewall writes entries security log when computer started , when program or system service attempts listen unsolicited incoming traffic blocked. these entries provide information status , configuration of windows firewall, including information applications , ports permit traffic through windows firewall. these entries provide information ports , protocols program or system services trying use can configure necessary exceptions in windows firewall. these security log entries viewed event viewer, can filter entries event ids. event ids associated windows firewall in range of 848 through 861.

note:

windows firewall events written event log time windows firewall/internet connection sharing service running, if windows firewall turned off (disabled).

 

when firewall turned off, program not blocked entries still written in event log.

 

thanks.

---

this posting provided "as is" no warranties, , confers no rights.

Windows Server  >  Security