Windows Security Log Event ID 849

849: An application was listed as an exception when the Windows Firewall started

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This isn't really an event per se.  It's just logged for each Windows Firewall application exception when the firewall starts in order to document the exceptions that were active at the time.  See also event ID 850.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 849

• Policy origin: Did the policy come from the local settings or from group policies in Active Directory? (Local Policy/Group Policy)
• Profile used: Standard or Domain? (based on whether computer is connected to it's "home" domain network or out travelling such as at a wi-fi hotspot)
• Name: Exception name
• Path: Full path name of the application allowed to listen for traffic
• State: Enabled or Disabled
• Scope: the IP Address and Subnet scopes to which traffic the policy applies or "All subnets" or "Local subnet"

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy