Audit Policy: Policy Change: MPSSVC Rule-Level Policy ChangeID: oval:org.secpod.oval:def:22563 | Date: (C)2015-01-07 (M)2021-06-02 |
Class: COMPLIANCE | Family: windows |
This subcategory reports changes in policy rules used by the Microsoft Protection Service (MPSSVC.exe). This service is used by Windows Firewall and by Microsoft OneCare. Events for this subcategory include:
? 4944: The following policy was active when the Windows Firewall started.
? 4945: A rule was listed when the Windows Firewall started.
? 4946: A change has been made to Windows Firewall exception list. A rule was added.
? 4947: A change has been made to Windows Firewall exception list. A rule was modified.
? 4948: A change has been made to Windows Firewall exception list. A rule was deleted.
? 4949: Windows Firewall settings were restored to the default values.
? 4950: A Windows Firewall setting has changed.
? 4951: A rule has been ignored because its major version number was not recognized by Windows Firewall.
? 4952 : Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.
? 4953: A rule has been ignored by Windows Firewall because it could not parse the rule.
? 4954: Windows Firewall Group Policy settings have changed. The new settings have been applied.
? 4956: Windows Firewall has changed the active profile.
? 4957: Windows Firewall did not apply the following rule:
? 4958: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer:
Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for the most recent information about this setting: http://support.microsoft.com/default.aspx/kb/947226.
Fix:
(1) GPO: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change!Audit Policy: Policy Change: MPSSVC Rule-Level Policy Change
(2) WMI: ###
Platform: |
Microsoft Windows 8.1 |