Firewall Configuration
Applies To: Windows Server 2008
Windows Firewall with Advanced Security supports several configuration settings that control how and when firewall and Internet Protocol security (IPsec) rules are applied. For example, changing the network location type, turning the firewall on or off, or resetting the firewall to its initial out-of-box configuration can affect which rules are applied to network traffic.
When appropriate auditing events are enabled (https://go.microsoft.com/fwlink/?linkid=92666), Windows reports when critical configuration changes occur that can affect the firewall and IPsec processing.
Events
| Event ID | Source | Message |
|---|---|---|
Microsoft-Windows-Security-Auditing |
Windows Firewall settings were restored to the default values. | |
Microsoft-Windows-Security-Auditing |
A Windows Firewall setting has changed. %t Profile That Was Changed:%t%1 New Setting: %tType:%t%2 %tValue:%t%3 |
|
Microsoft-Windows-Security-Auditing |
Windows Firewall has changed the active profile. New Active Profile:%t%1 |