Troubleshooting

This page helps resolve the most common issues related to creating, deploying, and operating Microsoft Defender Firewall rules.

Find the symptom in the table below, then expand the relevant item to review the recommended actions.

Quick diagnostics

Problem	What to check first
The rule was not applied on the computer	Whether eAgent connected to the server after the rule was saved
The deployment status does not have the value OK	System notifications and rule parameters
The rule does not work as expected	Whether it is active and whether the correct profile, direction, and action are selected
The application lost communication after the rule was activated	Disable the rule and check whether communication returns
Cannot edit the rule	Whether the edit icon is grayed out

Rule deployment

The rule was not applied on the computer

The rule is deployed when eAgent connects to the server and downloads the current configuration.

Check:

• whether the computer is available,

• whether eAgent is functioning properly,

• whether the computer is still assigned to the rule,

• status in the column Deployment Status.

The deployment status does not have the value OK

Verify:

• whether the specified program exists on the computer,

• whether the path to the program is correct,

• whether the correct TCP or UDP protocol was selected for the port rule,

• whether the correct local port was specified.

Rule operation

The rule was deployed, but it does not work as expected

Check whether:

• the toggle in the column Active is enabled,

• the correct traffic direction was selected - inbound or outbound,

• the correct action was set - allow or block,

• the rule covers the network profile in use - Domain, Private, or Public,

• the computer does not have other firewall rules deployed locally, through GPO, Intune, or another tool.

The application or service lost communication after the rule was activated

Disable the rule using the toggle in the column Active. After eAgent downloads the changes, check whether communication has been restored.

If the issue has been resolved, verify the rule parameters before enabling it again.

Test new blocking rules on a single computer first. Only after confirming they work should you assign them to more devices.

Cannot edit the rule

A grayed-out edit icon indicates a system-protected rule. It cannot be changed from eAuditor Cloud.

Before submitting a ticket to support

Bug report

For the ticket to be analyzed efficiently, it should contain all information required by the procedure below.

Tickets should be sent to:

[e-mail]

In the ticket content, provide:

• the contact details of the person responsible for communication regarding the ticket,

• as detailed a description of the issue as possible,

• the name or login of the user affected by the issue,

• the name of the associated computer,

• whether the issue affects one or multiple users,

• the name of the tab where the issue occurs,

• a description of the steps taken to resolve the issue independently,

• the date and time the issue occurred,

• the eAgent status and the date of the computer's last connection,

• the applied filters and the selected time range,

• screenshots, error messages, or other materials helpful for analysis.

After sending the message to [e-mail] the ticket will be automatically confirmed with a reply message.

If you do not receive a confirmation, the ticket may not have reached the support team. In that case, verify the recipient address and send the message again.

Do not send passwords, login credentials, access keys, or any other authentication information. If the analysis requires additional data, technical support will indicate a secure way to provide it.