Windows Security Log Event ID 4956

4956: Windows Firewall has changed the active profile

On this page

• Description of this event
• Field level details
• Examples

This event is logged whenever Windows Firewall switches between Domain and Public profiles.

You will usually see this event whenever Windows Firewall starts up since it starts out in Public and then after initialization switches to Domain if appropriate.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Mini-Seminars Covering Event ID 4956 Top 3 Workstation Logs to Monitor for Early Detection of Attacks: Security Log, PowerShell, Sysmon

 

Upcoming Webinars Assessing Your Active Directory: Group Related Risks

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy