Event ID 4945

A rule was listed when the Windows Firewall started

A rule was listed when the Windows Firewall started.

Profile used:   %1

Rule:
    Rule ID:    %2
    Rule Name:  %3


This event generates every time Windows Firewall service starts.

This event shows the inbound and/or outbound rule which was listed when the Windows Firewall started and applied for the “Public” profile. Unfortunately this event only ever shows rules for the Public profile.

This event generates per rule.

Auditing:     Always


Volume:     Low


Microsoft Documentation

Event ID - 4945



NameFieldInsertion StringOSExample
Profile usedProfileUsed%1Any Public
Rule IDRuleId%2Any NPS-NPSSvc-In-RPC
Rule NameRuleName%3Any Network Policy Server (RPC)

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"MPSSVC Rule-Level Policy Change"
How to enable Windows Auditing
Recommended Audit Policy

Operating Systems:
Windows VistaWindows 2008Windows 2008 R2Windows 7Windows 2012Windows 2012 R2Windows 8Windows 8.1Windows 10Windows 11Windows 2016Windows 2019Windows 2022Windows 2025

Tags:
Audit Success
Audit Category:
Policy Change

Audit Subcategory:
MPSSVC Rule-Level Policy Change
Legacy Events:
849850

LEFT/RIGHT arrow keys for navigation

Back to List