Windows Firewall Service Report

[chads]

Does anyone have a report for Windows Firewall Service disabled on computers? can only find old code on searching the forums

[marshall-o]

I think you can remove the bolded text below:

Select Top 1000000 tsysOS.Image As icon,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
tblAssets.IPAddress,
tblAssets.Firstseen,
tblAssets.Lastseen,
tblServicesUni.Caption,
tblServiceStartMode.StartMode,
tblServiceState.State
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Inner Join tblServices On tblAssets.AssetID = tblServices.AssetID
Inner Join tblServiceStartMode On tblServiceStartMode.StartID =
tblServices.StartID
Inner Join tblServiceState On tblServiceState.StateID = tblServices.StateID
Inner Join tblServicesUni On tblServicesUni.ServiceuniqueID =
tblServices.ServiceuniqueID
Where tblServiceStartMode.StartMode = 'disabled' And tblServicesUni.Name =
'MpsSvc'
Order By tblAssets.Domain,
tblAssets.AssetName

Although, I'm not too sure about this. Windows Firewall is definitely disabled on my computer since before the last scan and it's still reporting as running. Curious.

[FarcasR]

This report show all disabled firewall assets, but what should I chage to make it report all active firewalls ?

[Hemoco · Accepted solution]

Please use the report below for the information you are after.

Select Top 1000000 tsysOS.Image As icon,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
tblAssets.IPAddress,
tblAssets.Firstseen,
tblAssets.Lastseen,
tblServicesUni.Caption,
tblServiceStartMode.StartMode,
tblServiceState.State
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Inner Join tblServices On tblAssets.AssetID = tblServices.AssetID
Inner Join tblServiceStartMode On tblServiceStartMode.StartID =
tblServices.StartID
Inner Join tblServiceState On tblServiceState.StateID = tblServices.StateID
Inner Join tblServicesUni On tblServicesUni.ServiceuniqueID =
tblServices.ServiceuniqueID
Where tblServiceStartMode.StartMode = 'disabled' And tblServicesUni.Name =
'MpsSvc'
Order By tblAssets.Domain,
tblAssets.AssetName

To use the report above, do the following:
• Open the report builder under Reports/Create New Report.
• Paste the SQL code we provided at the bottom of the page.
• Left-click somewhere in the upper section of the page so the code applies.
• Give the report a Title and hit the Save & Run button to save it. Export options are listed on the left.