Windows Security Log Event ID 850

Operating Systems Windows 2003 and XP
CategoryPolicy Change
Type Success
Corresponding events
in Windows 2008
and Vista
4945  

850: A port was listed as an exception when the Windows Firewall started

On this page

This isn't really an event per se.  It's just logged for each Windows Firewall exception when the firewall starts in order to document the exceptions that were active at the time.

Free Security Log Resources by Randy

Description Fields in 850

  • Policy origin: Did the policy come from the local settings or from group policies in Active Directory? (Local Policy or Group Policy)
  • Profile used: Standard or Domain? (based on whether computer is connected to it's "home" domain network or out travelling such as at a wi-fi hotspot)
  • Interface: which NIC or "All interface"
  • Name: Exception name
  • Port number: self explanatory
  • Protocol: TCP or UDP
  • State: Enabled or Disabled
  • Scope: the IP Address and Subnet scopes to which traffic the policy applies

Supercharger Free Edition


Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

Examples of 850

A port was listed as an exception when the Windows Firewall started

Policy origin: Local Policy
Profile used: Standard
Interface: All interfaces
Name: SMTP
Port number: 25
Protocol: TCP
State: Enabled
Scope: 10.0.0.0/255.240.0.0,10.225.225.0/255.255.255.192,10.230.255.0/255.255.255.0,10.235.235.0/255.255.255.192,64.39.0.0/255.255.254.0,212.100.225.32/255.255.255.224

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection

 

Upcoming Webinars
    Additional Resources

      Go To Event ID:

      Security Log
      Quick Reference
      Chart
      Download now!