CODEWITHSUNDEEP
c++winapi
Abhishek
Abhishek

Reputation: 33

Is it possible to get a event in C++ program if Windows firewall status changes

I need to write a C++ application that should read firewall status of Windows, and then need to keep an eye continuously if admin/someuser changes the firewall status (lets say when my program was started firewall was disabled and after sometime Admin enabled it).

To implement this, I have created a thread that periodically(10 seconds) poll the code that checks Windows firewall status, but this doesn't look an efficient solution to me as continuous polling is required.

Is there a way to get event automatically in my program if firewall status changes (for example, FindFirstChangeNotification, using this I can get notification if any change in directory)? This will avoid continuous polling and will make program more efficient I think.

Any help is appreciated.

Upvotes: 0

Views: 261

Answers (1)

some-random-user-lurking-in
some-random-user-lurking-in

Reputation: 21

I know there is Windows ETW which anti-viruses use and which has all the info you need. It is a big system log where you subscribe to log/event providers. Pretty much everything that happens in system gets reported there via event which you can listen/wait for. I don't know the links to more useful pages with a list of loggers connected to ETW so here is the more general page: https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/event-tracing-for-windows--etw-. You need to find out how to use C++ ETW API and the name/ID of the firewall events provider with a list of event types, then using API subscribe to this provider and setup a callback for when an event that interests you (here change of firewall status) occurs and that is it.

Upvotes: 2

Related Questions