I've been using NIS for the last 3 years and it's time for me to decide whether or not I should renew my subscription. Hopefully, someone can help me with this issue and I'll renew for a few more years, but otherwise I don't see the point.
Can someone explain why the Program Control and Program Component Monitoring features do not seem to work together?
After reinstalling my Windows OS and NIS, I always turn off the Firewall's Automatic Program Control and turn on Advanced Events Monitoring. Next, I go to install my ethernet driver and during the setup I get my first NIS security alert. Its says a remote system is trying to access Host Process (svchost.exe). So I choose Block Always in the dropdown menu. After the install completes, I go to view the Program Control list and it shows one program (svchost.exe) as blocked. Then I go to look at Program Components Monitoring and it shows a long list of .dll and .exe files and says at the top: "You have identified that the components in this list are safe. All programs will be able to use these components to access the internet."
At this point, I haven't even connected to the internet for the first time or received any other firewall requests. Before I blocked svchost.exe, the list was empty and after blocking it says that I am allowing access to all these components (.dll and .exe) files.
How does NIS decide that those components should have internet access when the only program that ever requested internet access was blocked?
I really need someone to clarify what is going on here.
~Thanks