Can't add or edit firewall rules

[konradk 0]

Until a year ago, I had been using a trial version of ESET Internet Security without any problems. Then I bought a licence for a different antivirus software. Now that it's expired, I decided to buy a licence for ESET. And it's working fine, except for the fact that I can't add or edit rules. It says that there was an error while saving and to make sure I have privileges to change settings. I have no idea what's wrong and how to fix it.

[itman 1,659]

Are you logged on to Windows under a standard user account?

[konradk 0]

No, it's an administrator account.

[Marcos 5,074]

Are you able to change other settings and cannot save only firewall rules?

What OS do you have? Do you have UAC enabled?

[konradk 0]

It would appear so, but I didn't check all settings. 

Win 7 64bit Ultimate. UAC disabled.

Edited April 29, 2021 by konradk

[Marcos 5,074]

Please re-enable UAC and see if that helps.

[konradk 0]

Didn't help.

[itman 1,659]

As a test, create a HIPS rule; you can delete it afterwards. Is the rule created and saved w/o issue?

[konradk 0]

Yeah, it was created without a problem.

[Marcos 5,074]

Please provide a Procmon log from time when you attempt to save a firewall rule.

Have you tried uninstalling ESET and installing it from scratch?

[konradk 0]

Both the process and the boot log files?

Yeah, I tried that 3 times.

[Marcos 5,074]

1, Start logging with Procmon
2, Attempt to save a firewall rule
3, Stop logging
3, Save the log, compress it and upload it here.

[konradk 0]

I was asking if I'm supposed to create both logs that are mentioned there. But that tells me the process log is enough.

So, here it is Logfile.zip

[Marcos 5,074]

Please check if the Administrators group and System account have full control granted for C:\ProgramData\ESET\ESET Security.

[konradk 0]

I don't know how to check that, but I can't access the ESET folder. I'm getting the "You don’t currently have permission to access this folder" error. So, I guess I don't have full control.

[Marcos 5,074]

Please run:

icacls C:\ProgramData

and provide the output of the command.

[konradk 0]

"C:\ProgramData Everyone:(F)"

"Successfully processed 1 files; Failed processing: 0 files"

 

Btw, the original output was in Polish, but from what I googled it's how it should read in English.

[Marcos 5,074]

Please uninstall ESET temporarily and make sure that the folder C:\ProgramData\ESET\ESET Security doesn't exist. If exists, are you able to delete it? Are you able to create it manually and create and write to files in that folder? For an unknown reason ekrn was getting access denied when attempting to save rules there.

[konradk 0]

It didn't exist. I was able to create it and write files into it. 

But I think I solved the problem. I played with permission settings on the security tab of the ESET folder. I don't know if I should've done that in the first place, but it seems to have helped. 

Edited April 30, 2021 by konradk

[itman 1,659]

 

2 hours ago, konradk said:

It didn't exist. I was able to create it and write files into it. 

But I think I solved the problem. I played with permission settings on the security tab of the ESET folder.

Did you uninstall Eset, then re-install Eset after deleting the C:\ProgramData\ESET\ESET Security folder you created? The Eset installer will create this folder and populate it with data.

[konradk 0]

Actually, it was just C:\ProgramData\ESET folder. Somehow I didn't notice it was supposed to be C:\ProgramData\ESET\ESET Security. 

Anyway, no, I didn't delete that folder. But after reinstalling ESET, it became inaccessible. Then I checked the properties of the folder and fiddled with the security settings and got it working.