Windows update wuauclt.exe not showing in Alerts or Graph

#1

My Firewall is On and set to “Ask to Connect”.

An hour ago Glasswire’s popup Alert asked me if I wanted to allow wuauclt.exe (Windows Update) to connect to the internet, which I clicked allowed.
Wuauclt.exe is now correctly showing in the list of Apps in the Firewall tab with the name Windows Update, with full access to the internet.

However, I can find no record of wuauclt.exe connecting to the internet in the Alerts tab.
Also, when on click on the Usage tab, for May 3, wuauclt.exe (Windows Update) does not show wuauclt.exe/Windows Update.

Why doesn’t wuauclt.exe show up in the Alerts or Usage page?

I want see what IP address Windows Update was using, but can’t find the historical transaction in the logs.

#2

@JoeyT

If you go to your control panel and run Windows Update again do you get a “new” network access notification? Perhaps since the application was paused initially it did not make a connection yet.

#3

When I tried your suggestion I found the latest Windows Update was in a pending update mode, requiring me to reboot my machine to finish the update. After rebooting my machine the Windows Update then appeared in the GW Alerts and Graph.

Is this delayed posting to the Alerts and Graph by design?

It does not seem logical to me that the wuauclt.exe appeared in the Firewall list, meaning it had allowed access to the Internet, but not in the Alerts and Graph logs, until I rebooted my machine.

Also, when I rebooted to complete the windows update, I noticed a similar issue.

Microsofts whatsnew.store.exe wanted access to the internet. I denied the access. whatsnew.store.exe now appears in the Firewall list, with access denied.

However, no record whatsnew.store.exe appears in the Alerts or Graph.
I assume this is also by design?

I would prefer that the Alerts and Graph show all Apps trying to access the internet, whether or not I allowed access.

It appears that Apps denied access to the internet never appear in the Alerts and Graph logs?

#4

@joeyT

Now I understand. Sorry for any confusion.

No, apps that try to access the network and fail to connect don’t show up on the graph at all. We only show successful “New” connections. Perhaps this is a feature we can add in the future in our settings/security section.

We have been looking at adding a separate log section that’s different from alerts. In that section it would log all GlassWire activity, for example anything you do like blocking, unblocking, etc… kind of like what antiviruses do in their log sections.

#5

Yes, it would be extremely useful to have a log available showing every action the Firewall took, blocking/unblocking.

This would be extremely helpful because the log would tell us all the apps that are still/always trying to connect to the internet, but have been denied.
As it is now, I have no clue if an App I denied access 6 months ago is still active and trying to access the internet.
The only work around would be to delete all the Apps from the Firewall and start from scratch again, to see which apps are still active.

2 Likes
#6

@JoeyT

GlassWire will put old apps in “inactive apps” if they have not tried to access the network in 30 days, then you can mouse over “inactive apps” and a small X will appear, then you can clear them.

If your GlassWire install is new you will not see “inactive apps” yet with the firewall.

This doesn’t do exactly what you want, but I wanted to make sure you knew about “inactive apps” in the future and what it does.

#7

Thanks. I am still in the 30 day window.

In addition to adding a new logging feature mentioned previously, to show every action the Firewall took, here is I believe a smaller request.

Add an Alerts button (or some other name) to the denied Apps, and show the first date/time it tried to access the internet, and the IP/Host it was trying to connect to. Since GW initiates a pop-up on the Apps first attempt to access the internet, it would appear this IP/Host/date could be stored/attached to an Alerts (or other name) button.

Currently in the Firewall tab, when you left click on an Application, that has been granted/allowed access (such as Firefox) to the internet, there is an Alerts button that shows the first activity time/date the App accessed the internet.
Unfortunately there is no Alerts button for Apps that have been denied access.

#8

Great feedback, thanks! Also, the free trial is 7 days not 30.