Windows Security Log Event ID 848

Operating Systems Windows 2003 and XP
CategoryPolicy Change
Type Success
Corresponding events
in Windows 2008
and Vista

848: The following policy was active when the Windows Firewall started

On this page

This event is logged once each time Windows Firewall start which is usually at boot up.  This event documents the highlevel policy settings in effect at the time of startup.

Free Security Log Resources by Randy

Description Fields in 848

  • Group Policy Applied: should indicate whether Windows Firewall was getting its settings from Group Policy or the system's local policy but this appears to always say "No"
  • Profile Used: "Standard" or "Domain".  Windows Firewall seems to always start in Public and then switch to Domain shortly after if appropriate.
  • Interfaces: which NICs? "All interfaces", if all.
  • Operational mode: Whether Windows Firewall was enabled or not.  Should usually say "On".


  • File and Printer Sharing: Disabled/Enabled
  • Remote Desktop: Disabled/Enabled
  • UPnP Framework: Disabled/Enbabled
  • Allow Remote Administration: Disabled/Enbabled
  • Allow Unicast Responses to Multicast/Broadcast Traffic: Enabled/Disabled

Security Logging:

The logging referred to here has nothing to do with the Security event log; instead it's referring to the C:\Windows\system32\LogFiles\Firewall\pfirewall.log log.

These fields corresponds to the check box in the Customize Loggin Settings for the Public/Domain Profile dialog in Windows Firewall with Advanced Security MMC console.

  • Log dropped packets: Disabled/Enabled/-
  • Log successful connections: Disabled/Enabled/-


  • Allow incoming echo request: Disabled/Enabled/-
  • Allow incoming timestamp request: Disabled/Enabled/-
  • Allow incoming mask request: Disabled/Enabled/-
  • Allow incoming router request: Disabled/Enabled/-
  • Allow outgoing destination unreachable: Disabled/Enabled/-
  • Allow outgoing source quench: Disabled/Enabled/-
  • Allow outgoing parameter problem: Disabled/Enabled/-
  • Allow outgoing time exceeded: Disabled/Enabled/-
  • Allow redirect: Disabled/Enabled/-
  • Allow outgoing packet too big: Disabled/Enabled/-

Supercharger Free Edition


Examples of 848

The following policy was active when the Windows Firewall started.

Group Policy applied: No
Profile used: Standard
Interface: All interfaces
Operational mode: On

File and Printer Sharing: Disabled
Remote Desktop: Enabled
UPnP Framework: Disabled
Allow remote administration: Disabled
Allow unicast responses to multicast/broadcast traffic: Disabled

Security Logging:

Log dropped packets: Disabled
Log successful connections: Disabled


Allow incoming echo request: Enabled
Allow incoming timestamp request: Disabled
Allow incoming mask request: Disabled
Allow incoming router request: Disabled
Allow outgoing destination unreachable: Disabled
Allow outgoing source quench: Disabled
Allow outgoing parameter problem: Disabled
Allow outgoing time exceeded: Disabled
Allow redirect: Disabled
Allow outgoing packet too big: Disabled

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources