Windows Security Log Event ID 5031

5031: The Windows Firewall Service blocked an application from accepting incoming connections on the network.

On this page

• Description of this event
• Field level details
• Examples

It's strange that this event refers to "Windows Firewall Service" when it is supposed to be a Filtering Platform Connection event.  Windows Firewall is built on top of the Windows Filtering Platform.  Perhaps it's because there is not Windows Firewall subcategory for connection type events.

At any rate as the description says, Windows Firewall prevented an application from accepting incoming connections due to absence of an appropriate Exception in the current profile's policy.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 5031

• Profiles:  %1
• Application:  %2

Supercharger Enterprise

Load Balancing for Windows Event Collection

 

Mini-Seminars Covering Event ID 5031 How to Monitor Network Activity with the Windows Security & Firewall Logs to Detect Inbound and Outbound Attacks

 

Upcoming Webinars Uncovering and Addressing the Blind Spots in Privileged Access Management Agentless Event Log Collection for the Modern Entra-Joined Windows 11 Endpoint The Changing Landscape of Authentication and Logon Tracking in Hybrid Environments of Entra and AD

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy