Okay, found DisableEx was set to 0, fixed, thanks! What do those entries do? -----Original Message----- From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Friday, March 18, 2005 00:28 To: [ISAserver.org Discussion List] Subject: [isalist] RE: Port Scans http://www.ISAserver.org You broke your firewall client application settings. There should be *NO* entries in your firewall log from svchost.exe. Go to "Configuration, General, Define Firewall Client Settings, Application Settings. There should be two the "svchost" entries: Disable = 1 DisableEx = 1 ..If you don't find any, create them.