[size=10pt]My new W7 machine has “Works 9 with Ads” pre-loaded. I decided to use AIS Firewall to block it getting outbound access to the
internet.
On a User (non-Admin) account this is what happened:
Default Rules set to Auto-decide.
Application Rule for Works set to Block all connections.
Open Works - Application Rule reverts to Friends in/Internet out - Works connect to internet.
On an Admin account the firewall worked fine:
Default Rules set to Auto-decide
Application Rule for Works set to Block all connections.
Works is blocked from accessing internet.
Since I normally work in a user account this worries me a bit - if I hadn’t had the “show newly created allow rules” box checked,
applications that I thought I had blocked would be connecting.
It seems you have to go into an Admin account to set firewall rules
that you want to “stick”.
Anyone know if this is expected behaviour on a W7 User account?
hmm…no this is not normal…you should be able to tweak rules from a standard account. Well, I don’t use a standard account so I can’t tell if the behavior is wanted or if there’s a bug, or just how it would behave here.
There’s something that could be tried in computer management but that’s no real solution, so I won’t describe it. I’ll pm the guy in charge of the firewall development @ avast. He’ll probably come to check the thread here.
I’ve logged out and in, deleted all the rules for Works and let them recreate, and now I can’t repeat the behaviour (update - yes I can see below). It blocks Works every time. Somehow those original rules seem to have been a problem.
Something else odd I noticed though. I run firewall under Public - no new programs. I just downloaded steve gibsons firewall leak tester, and it ran and connected. Shouldn’t it have been blocked as new program, or am I misinterpreting that?
Once I blocked it it remained blocked though.
Update. Just tried again. Deleted all the Works rules, restarted Works to let them autogenerate, set to Block - and now the Rule changes to Friends in/internet out every time.
I don’t seem to be very lucky with this Firewall - hardly anyone else seems to report problems as far as I can judge from the forum.
I have investigated a bit further. I now don’t think this has anything to do with account type. I think it’s something I’ve seen before - I just didn’t recognise it.
wksss.exe exists with two filenames - shortform and longform. If you only have a rule for blocking one the program keeps connecting. If you have block rules for both it can’t connect.
When I logged on as Admin I selected a start for the wksss.exe that used the other file name - and so got two block rules set.