Is it possible to see changes made to windows firewall in recent past?

Solution 1:

The Windows Firewall with Advanced Security operational event logs that can be viewed in Event Viewer. The events in this log show the operational status of Windows Firewall with Advanced Security and changes in its configuration.

You do not have to enable Firewall logging for the event viewer to capture these events, logging is for other purposes as stated in the "Source" link below.

Source

.

How to view the Event logs for the Firewall

Operational event logs in Event Viewer

.

There are four views of operational events provided:

ConnectionSecurity. This log maintains events that relate to the configuration of IPsec rules and settings. For example, when a connection security rule is added or removed or the settings of IPsec are modified, an event is added here.

ConnectionSecurityVerbose. This log maintains events that relate to the operational state of the IPsec engine. For example, when a connection security rule become active or when crypto sets are added or removed, an event is added here. This log is disabled by default. To enable this log, right-click ConnectionSecurityVerbose, and then click Enable Log.

Firewall. This log maintains events that relate to the configuration of Windows Firewall. For example, when a rule is added, removed, or modified, or when a network interface changes its profile, an event is added here.

FirewallVerbose. This log maintains events that relate to the operational state of the firewall. For example, when a firewall rule become active, or when the settings of a profile are changed, an event is added here. This log is disabled by default. To enable this log, right-click FirewallVerbose, and then click Enable Log.