Event ID 4946 - A change was made to the Windows Firewall exception list. A rule was added

Event ID: 4946

A change was made to the Windows Firewall exception list. A rule was added

A change was made to the Windows Firewall exception list. A rule was added.

Profile Changed:   %1

Added Rule:
    Rule ID:   %2
    Rule Name: %3

This event generates when new rule was locally added to Windows Firewall.

This event doesn't generate when new rule was added via Group Policy.

	Field	Insertion String	OS	Example
Profile Changed	ProfileChanged	%1	Any	All
Rule ID	RuleId	%2	Any	{F2649D59-1355-4E3C-B886-CDD08B683199}
Rule Name	RuleName	%3	Any	Allow All Rule


  C:\> AuditPol.exe /get  /subcategory:"MPSSVC Rule-Level Policy Change"

Policy Change

851 852

LEFT/RIGHT arrow keys for navigation