This subcategory reports changes in policy rules used by the Microsoft Protection Service (MPSSVC.exe). This service is used by Windows Firewall and by Microsoft OneCare. Events for this subcategory include: ? 4944: The following policy was active when the Windows Firewall started. ? 4945: A rule was listed when the Windows Firewall started. ? 4946: A change has been made to Windows Firewall exception list. A rule was added. ? 4947: A change has been made to Windows Firewall exception list. A rule was modified. ? 4948: A change has been made to Windows Firewall exception list. A rule was deleted. ? 4949: Windows Firewall settings were restored to the default values. ? 4950: A Windows Firewall setting has changed. ? 4951: A rule has been ignored because its major version number was not recognized by Windows Firewall. ? 4952 : Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. ? 4953: A rule has been ignored by Windows Firewall because it could not parse the rule. ? 4954: Windows Firewall Group Policy settings have changed. The new settings have been applied. ? 4956: Windows Firewall has changed the active profile. ? 4957: Windows Firewall did not apply the following rule: ? 4958: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer: Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for the most recent information about this setting: http://support.microsoft.com/default.aspx/kb/947226. Fix: (1) GPO: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change!The policy setting for this audit category determines whether to audit MPSSVC Rule-Level Policy changes on computers running Windows Vista or later Windows operating systems. (2) REG: NO REGISTRY INFO