Event ID 4953
Windows Firewall ignored a rule because it could not be parsedWindows Firewall ignored a rule because it could not be parsed.
Profile: %1
Reason for Rejection: %2
Rule:
ID: %3
Name: %4This event generates if Windows Firewall was not able to parse Windows Firewall rule for some reason.
It can happen if a Windows Firewall rule registry entry was corrupted, or from misconfigured Group Policy settings.
Auditing: Always Usually indicates a configuration issue, not a security issue.
| Name | Field | Insertion String | OS | Example | |
|---|
| Profile | Profile | %1 | Any | All |
| Reason for Rejection | ReasonForRejection | %2 | Any | An error occurred. |
| ID | RuleId | %3 | Any | SearchProtocolHost-2 |
| Name | RuleName | %4 | Any | - |
The list of profiles to which deleted rule was applied. Examples:
All
Domain,Public
Domain,Private
Private,Public
Public
Domain
Private
The reason why the rule was ignored.
The unique identifier for ignored firewall rule.
To see the unique ID of the rule you can to navigate to the “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules” registry key and you will see the list of Windows Firewall rule IDs, with the "Name" column containing the rule ID value.
The name of the rule that was ignored.
You can see the name of Windows Firewall rules using "Windows Firewall with Advanced Security" management console (wf.msc), the “Name” column can be used to match the "Rule Name" value from the event.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"MPSSVC Rule-Level Policy Change"
LEFT/RIGHT arrow keys for navigation
Back to List