W10 Famille - 21H1 - 19043.1237 / CFW : 220.127.116.1112
The FW is set at the level “Safe Mode”.
I use Glasswire to monitor my laptop’s Internet access.
I used the Microsoft PHOTOS program for the first time.
Its rating is “Trusted” (screeshot1).
Glasswire informs me that the PHOTOS program has connected to the Internet (screenshot2).
Because of the level “Safe Mode”, rules should have been created automatically in “Application Rules”. But no rule has been created.
There are no events in the FW and HIPS logs.
Would you have a possible explanation ?
Not unless you have “Create rules for safe applications” enabled for Firewall and/or HIPS in Safe Mode.
To create the rule, I could not access the program directly because of a problem of rights on the directory.
I ran the program and created the rule using the “Running process” function and setting “Log as a firewall event if this rule is fired” enabled.
I closed the program and ran it again.
There is no event in the FW log.
Maybe the program accesses the Internet at its first launch.
It could be that the Microsoft PHOTOS program connects to the internet using the svchost service.