Source Destination Port ProtocolCSA Agent CSAMC Server 80 TCPCSA Agent CSAMC Server 443 TCPCSA Agent CSAMC Server 5401 TCPCSAMC Server Each CSA Agent 5401 UDP
Do you know what application is causing the issue? Can you get to (physically/RDP) the devices causing and accepting the events? You might want to run process explorer (http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplor...
You can create a very broad but insecure rule that would allow remote application, from any user to access the registry. I would not recommend this but you could do this in test mode and start working you way backward to increase the granularity and...
