Event ID: 4946

A change was made to the Windows Firewall exception list. A rule was added

A change was made to the Windows Firewall exception list. A rule was added.

Profile Changed:   %1

Added Rule:
    Rule ID:   %2
    Rule Name: %3

This event generates when new rule was locally added to Windows Firewall.

This event doesn't generate when new rule was added via Group Policy.

Auditing: Always

Volume: Low

Microsoft Documentation

Event ID - 4946

	Field	Insertion String	OS	Example
Profile Changed	ProfileChanged	%1	Any	All
Rule ID	RuleId	%2	Any	{F2649D59-1355-4E3C-B886-CDD08B683199}
Rule Name	RuleName	%3	Any	Allow All Rule


  C:\> AuditPol.exe /get  /subcategory:"MPSSVC Rule-Level Policy Change"

Policy Change

851 852

LEFT/RIGHT arrow keys for navigation