Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx
LogRisk: Caution

Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Windows Firewall log (Firewall channel): rule added (2004), modified (2005) and deleted (2006); does not record blocked packets.

Updated on By AltF4 Formation

What it’s for

The Microsoft-Windows-Windows Firewall With Advanced Security/Firewall channel keeps the history of firewall configuration changes: who added, modified or deleted a rule, and when. It does not hold blocked or allowed traffic, which is logged elsewhere.

What it contains

  • 2004: rule added (name, application, ports, profile, action).
  • 2005: rule modified.
  • 2006: rule deleted.
  • 2003: profile setting changed (enabled state, default behavior).
  • Events identify the process or account behind the change.

Risks and best practices

  • To find out why a flow is refused, look elsewhere: enable dropped-connection logging in pfirewall.log, or auditing of the filtering platform (events 5152 and 5156 in the Security log).
  • On a fleet, rules pushed by Group Policy also show up in this log when applied; look for the account that changed a rule locally to spot a bypass.
  • A rule added by an application during its installation (2004) is normal; an unknown inbound allow rule is not.

Useful commands

Fenêtre de terminal
# Rule additions, modifications and deletions over 30 days
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Firewall With Advanced Security/Firewall'; Id=2004,2005,2006; StartTime=(Get-Date).AddDays(-30)} |
    Select-Object TimeCreated, Id, Message


# Firewall logging settings (pfirewall.log)
Get-NetFirewallProfile | Select-Object Name, Enabled, LogAllowed, LogBlocked, LogFileName


# Enable dropped-connection logging (as administrator)
netsh advfirewall set allprofiles logging droppedconnections enable

Format

Binary XML file (.evtx). The “/” in the channel name becomes “%4” in the file name.

Rotation and archiving

Maximum size and behavior when full are set in the log properties or through Group Policy; wevtutil gl shows the configuration and wevtutil epl exports the log to an .evtx file.

How to read it

In Event Viewer, go to Applications and Services Logs, Microsoft, Windows, Windows Firewall With Advanced Security, Firewall. Filter on 2004, 2005 and 2006 and read the rule name and application path in the message.

Report a mistake