Verify listener binding and Windows Firewall rules#

When to use this procedure#

Use when a listener cannot start or a remote sender cannot reach it.

Applies to#

This procedure applies to MonitorWare Agent.

Prerequisites#

  • Use an account that can read the product configuration and Windows diagnostic state.

  • Replace angle-bracket placeholders with values from the affected system.

Safety#

  • Run diagnostic checks before changing configuration.

  • Remove passwords, private keys, license data, and other secrets from evidence.

Configuration path#

Configuration Client > the service, rule, or action named on the Event ID page.

Procedure#

  1. Record the configured local address, address family, transport, and port.

    Expected result: The affected object and its effective settings are identified.

    If it fails: Return to the complete Event Log detail and configuration export before changing settings.

  2. Run the native Windows checks below from the affected product host.

    Get-NetTCPConnection -State Listen -LocalPort <PORT> | Format-Table LocalAddress,LocalPort,OwningProcess
Get-NetUDPEndpoint -LocalPort <PORT> | Format-Table LocalAddress,LocalPort,OwningProcess
Get-NetFirewallRule -Enabled True -Direction Inbound | Get-NetFirewallPortFilter | Where-Object LocalPort -eq '<PORT>' | Format-Table Protocol,LocalPort

    Expected result: The intended process owns the endpoint and an approved allow rule covers its transport and profiles.

    If it fails: Correct wildcard/address conflicts or the narrow firewall rule; never disable Windows Firewall as a repair.

  3. Perform one uniquely identifiable product test through the same service, rule, or action.

    Expected result: The intended destination records the test exactly once.

    If it fails: Collect the first new product event and bounded debug output; do not change unrelated settings.

Verify the result#

Repeat the affected operation, confirm its positive output, and verify that queues, collection positions, or remote delivery continue normally.

Evidence to collect#

  • The complete Event Log entry and neighboring product events with timestamps.

  • The command output, relevant configuration export, and bounded debug log from the same interval.