Event ID 4956

Windows Firewall changed the active profile

Windows Firewall changed the active profile.

New Active Profile: %1

This event generates when Windows Firewall has changed the active profile.

Auditing: Always

Volume: Low

Microsoft Documentation

Event ID - 4956

Name		Field	Insertion String	OS	Example
	New Active Profile	ActiveProfile	%1	Any	Domain

C:\> AuditPol.exe /get /subcategory:"MPSSVC Rule-Level Policy Change"

LEFT/RIGHT arrow keys for navigation