Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 910771" data-attributes="member: 32260">You do not need to turn off the Log (it will not help). The 24 hours limitation follows from the fact that on Windows 10 there are many inbound connection events that can wipe out other events in the Windows Security Log.[URL unfurl=&quot;true&quot;]https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152[/URL]FirewallHardening makes the Security Log twice as bigger as the default Log (MaxSize = 0x01400000) and this is usually OK for surviving the events related to outbound connections for about 24 hours. If you want you can tweak the MaxSize of the log:HKLM\SYSTEM\CurrentControlSet\Services\EventLog\SecurityMaxSize = 0x02800000&nbsp; (change to a bigger value)When you turn Off Logging, the value is automatically changed to Windows default (MaxSize = 0x01400000).When you turn ON logging, the value is twice bigger (MaxSize = 0x02800000). So, do not turn OFF/ON Logging if you tweaked MaxSize.Anyway, you should look at the time moments in the Log when the AdGuard connections were blocked to find the possible correlation with the process which blocks AdGuard.</blockquote>

[QUOTE="Andy Ful, post: 910771, member: 32260"] You do not need to turn off the Log (it will not help). The 24 hours limitation follows from the fact that on Windows 10 there are many [COLOR=rgb(184, 49, 47)][B]inbound connection events [/B][/COLOR]that can wipe out other events in the Windows Security Log. [URL unfurl="true"]https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152[/URL] FirewallHardening makes the Security Log twice as bigger as the default Log (MaxSize = 0x01400000) and this is usually OK for surviving the events related to outbound connections for about 24 hours. If you want you can tweak the MaxSize of the log: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security MaxSize = 0x02800000 (change to a bigger value) When you turn Off Logging, the value is automatically changed to Windows default (MaxSize = 0x01400000). When you turn ON logging, the value is twice bigger (MaxSize = 0x02800000). So, do not turn OFF/ON Logging if you tweaked MaxSize. [B]Anyway, you should look at the time moments in the Log when the AdGuard connections were blocked to find the possible correlation with the process which blocks AdGuard.[/B] [/QUOTE]

Verification