When the Windows Firewall blocks an application from connecting, it logs the event to the event log, which causes Windows Firewall Notifier to launch and display a notification, requesting your input.
It then enables the outbound connection logging feature in the Windows Firewall and creates a scheduled task linked to the Windows Firewall events. When you install and activate Windows Firewall Notifier, it enables the Windows Firewall (if its disabled) and sets it to block outgoing traffic by default. It doesn’t always run in the background – instead, it uses a few clever tricks to hook into the existing Windows Firewall infrastructure.
