Audit Policy: Policy Change: MPSSVC Rule-Level Policy Change
|ID: oval:org.secpod.oval:def:22854||Date: (C)2015-01-07 (M)2018-03-24|
|Class: COMPLIANCE||Family: windows|
This subcategory reports changes in policy rules used by the Microsoft Protection Service (MPSSVC.exe). This service is used by Windows Firewall and by Microsoft OneCare. Events for this subcategory include:
? 4944: The following policy was active when the Windows Firewall started.
? 4945: A rule was listed when the Windows Firewall started.
? 4946: A change has been made to Windows Firewall exception list. A rule was added.
? 4947: A change has been made to Windows Firewall exception list. A rule was modified.
? 4948: A change has been made to Windows Firewall exception list. A rule was deleted.
? 4949: Windows Firewall settings were restored to the default values.
? 4950: A Windows Firewall setting has changed.
? 4951: A rule has been ignored because its major version number was not recognized by Windows Firewall.
? 4952 : Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.
? 4953: A rule has been ignored by Windows Firewall because it could not parse the rule.
? 4954: Windows Firewall Group Policy settings have changed. The new settings have been applied.
? 4956: Windows Firewall has changed the active profile.
? 4957: Windows Firewall did not apply the following rule:
? 4958: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer:
Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for the most recent information about this setting: http://support.microsoft.com/default.aspx/kb/947226.
(1) GPO: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change!The policy setting for this audit category determines whether to audit MPSSVC Rule-Level Policy changes on computers running Windows Vista or later Windows operating systems.
(2) REG: NO REGISTRY INFO
|Microsoft Windows Server 2012 R2|