Morpheus

Found a couple of errors, try the attached.
php.ini

I just noticed:
 
Change this: d:winidssnortbinsnort -c d:winidssnortetcsnort.conf -l d:winidssnortlog –i1 -T
 
To this: d:winidssnortbinsnort -c d:winidssnortetcsnort.conf -l d:winidssnortlog -i1 -T

All fixed. Seems they are having a problem with file extensions, again...

It reads this registry key: HKLM > SOFTWARE > Microsoft > Windows NT > CurrentVersion
Expects a value of 6.3 in the CurrentVersion value for all versions of Windows 8.x
You are supposed to run the modder.vbs file from a CMD window that has Administrator privileges.
Right-clicking the file, and "Run as Administrator", should also work?

I ended up deleteing the log files to get it to correctly update the date. The events were correct but didn't have the correct date. I believe this is due to a corrupted waldo file.
To fix; use the Windows Intrusion Detection Systems security console and delete all the events.
Stop snort and Barnyard2 from the Task Manager,
Go into the d:\winids\snort\logs folder, delete all the files, and reboot.
 

You need to mirror all the ports to the WinIDS, so you will need a managed switch.
You could also connect a "Throwing Star LAN Tap" from greatscottgadgets.com into the connection.
 

Preform a fresh install of Windows 10, and then use this tutorial to install the Windows Intrusion Detection System per the support programs you requested.

You should have checked and verified the tables per the tutorial.
The error states there is a problem with the archive database.
Below is how to check the existence of the tables in the archive database.
If the tables are missing then you might need to reinstall, and make sure that no steps are missed.
Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\Operator>mysql -u root -pd1ngd0ng mysql: [Warning] Using a password on the command line interface can be insecure. Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 7 Server version: 5.7.18-log MySQL Community Server (GPL) Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql> connect archive; Connection id: 8 Current database: archive mysql> show tables; +-------------------+ | Tables_in_archive | +-------------------+ | acid_ag | | acid_ag_alert | | acid_event | | acid_ip_cache | | base_roles | | base_users | | data | | detail | | encoding | | event | | icmphdr | | iphdr | | opt | | reference | | reference_system | | schema | | sensor | | sig_class | | sig_reference | | signature | | tcphdr | | udphdr | +-------------------+ 22 rows in set (0.00 sec) mysql>

You failed to follow the tutorial and made this an install that cannot be supported. Go back and start over following the tutorial and this will work so much better. 

You failed to follow the tutorial and made this an install that cannot be supported. Go back and start over following the tutorial and this will work so much better. 

Go back to the section titled below to get the solution:
Testing the Windows Intrusion Detection System (WinIDS) for network traffic

The problem is that it is not finding the base.php file, or possibly the base_conf.php file? It has to find the file first before trying to execute it.
Not sure if it could be the problem but make sure the config file is correctly named: base_conf.php
Maybe some sort of a permission problem with the files in the base folder?
Not sure how a permission problem could be the problem when the test.php file is working.
You are going to have issues with WinPcap and Npcap both installed. Use either one but not both.
Note: Uninstall both and then install the one you are going to use. Make sure Snort is not running when you uninstall.

The config files look good. It's usually quicker to start fresh.

1) Wonder what else didn't happen when the modder.vbs file ran?
 
2) Sourcefire has updated their snort.org site in the past few days and there has been issues with the rules, and opensource files?
 
3) I'm not sure as that has never happened here. This is most likely an issue related to item 1
 
I'll look into item 2 and adjust to the new name.
 
Update: Several of the file names were changed on the snort.org site, and all the tutorials now reflect those changes.