Windows Security Log Event ID 855
Operating Systems Windows XP
Windows Server 2003
CategoryPolicy Change
Type Success
Corresponding events
in Windows 2008
and Vista
4950  
Discussions on Event ID 855
Ask a question about this event

855: A Windows Firewall ICMP setting has changed

On this page

Windows logs this event when an administrator changes the local policy of the Windows Firewall or a group policy refresh results in a change to the Windows Firewall ICMP settings.

The event can contain the following settings values, one at a time: Allow incoming echo request, Allow outgoing destination unreachable, Allow redirect, Allow outgoing time exceeded, Allow outgoing parameter problem, Allow outgoing source quench, Allow incoming router request, Allow incoming timestamp request, Allow incoming mask request, Allow outgoing packet too big.

  • Policy origin: Group Policy or Local Policy
  • Profile changed: Standard or Domain
  • Interface: The network interface cards it applies to, or "All interfaces".
  • New Settings:
    (one of the following)
    • Allow incoming echo request: Enabled or Disabled
    • Allow outgoing destination unreachable: Enabled or Disabled
    • Allow redirect: Enabled or Disabled
    • Allow outgoing time exceeded: Enabled or Disabled
    • Allow outgoing parameter problem: Enabled or Disabled
    • Allow outgoing source quench: Enabled or Disabled
    • Allow incoming router request: Enabled or Disabled
    • Allow incoming timestamp request: Enabled or Disabled
    • Allow incoming mask request: Enabled or Disabled
    • Allow outgoing packet too big: Enabled or Disabled
  • Old Settings
    (one of the following)
    • Allow incoming echo request: Enabled or Disabled
    • Allow outgoing destination unreachable: Enabled or Disabled
    • Allow redirect: Enabled or Disabled
    • Allow outgoing time exceeded: Enabled or Disabled
    • Allow outgoing parameter problem: Enabled or Disabled
    • Allow outgoing source quench: Enabled or Disabled
    • Allow incoming router request: Enabled or Disabled
    • Allow incoming timestamp request: Enabled or Disabled
    • Allow incoming mask request: Enabled or Disabled
    • Allow outgoing packet too big: Enabled or Disabled

Top 10 Windows Security Events to Monitor

A Windows Firewall ICMP setting has changed.
 
Policy origin: Local Policy
Profile changed: Standard
Interface: All interfaces
New Setting:
     Allow outgoing destination unreachable: Enabled
Old Setting:
     Allow outgoing destination unreachable: Disabled

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this



Training for the Windows Security Log