Event ID: 4954

Group Policy settings for Windows Firewall were changed, and the new settings were applied. 

Group Policy settings for Windows Firewall were changed, and the new settings were applied.
Microsoft Documentation

Event ID - 4954




Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"MPSSVC Rule-Level Policy Change"
How to enable Windows Auditing

Operating Systems:
Windows Vista Windows 2008 Windows 2008 R2 Windows 7 Windows 2012 Windows 2012 R2 Windows 8 Windows 8.1 Windows 10 Windows 2016 Windows 2019

Audit Category:
Policy Change

Audit Subcategory:
MPSSVC Rule-Level Policy Change
Legacy Events:
858 859

LEFT/RIGHT arrow keys for navigation

Back to List