Event ID: 4956

Windows Firewall changed the active profile

Windows Firewall changed the active profile.

New Active Profile: %1
Microsoft Documentation

Event ID - 4956

This event generates when Windows Firewall has changed the active profile.

Name Field Insertion String OS Example
New Active Profile ActiveProfile %1 Any Domain

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"MPSSVC Rule-Level Policy Change"
How to enable Windows Auditing

LEFT/RIGHT arrow keys for navigation

Back to List