Event ID: 4956

Windows Firewall changed the active profile

Windows Firewall changed the active profile.

New Active Profile: %1

This event generates when Windows Firewall has changed the active profile.

Auditing:     Always

Volume:     Low

Microsoft Documentation

Event ID - 4956

Name Field Insertion String OS Example
New Active Profile ActiveProfile %1 Any Domain

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"MPSSVC Rule-Level Policy Change"

LEFT/RIGHT arrow keys for navigation

Back to List