Event ID 2071 —
Description
A rule has been added to the Windows Defender Firewall exception list.
Fields #
| Name | Description |
|---|---|
RuleId UnicodeString | GUID uniquely identifying the new firewall rule |
RuleName UnicodeString | Name of the firewall rule as it appears in Windows Firewall |
Origin UInt32 | — |
ApplicationPath UnicodeString | Path to the application this rule applies to, if application-specific |
ServiceName UnicodeString | Name of the service this rule applies to, if service-specific |
Direction UInt32 | Direction of the rule: 1 for inbound, 2 for outbound Known values
|
Protocol UInt16 | — Known values
|
LocalPorts UnicodeString | — |
RemotePorts UnicodeString | — |
Action UInt32 | Firewall action: 3 for allow, 2 for block |
Profiles UInt32 | Firewall profiles (Private/Domain/Public) this rule applies to Bitmask flags
|
LocalAddresses UnicodeString | — |
RemoteAddresses UnicodeString | — |
RemoteMachineAuthorizationList UnicodeString | — |
RemoteUserAuthorizationList UnicodeString | — |
EmbeddedContext UnicodeString | — |
Flags UInt16 | — |
Active UInt16 | Whether the rule is enabled: 0 for disabled, 1 for enabled |
EdgeTraversal UInt16 | — |
LooseSourceMapped UInt16 | — |
SecurityOptions UInt16 | Security options: 0 for none, 1 for require authentication |
ModifyingUser SID | SID of the account that added the firewall rule |
ModifyingApplication UnicodeString | Full image path of the process that added the firewall rule |
SchemaVersion UInt16 | — |
RuleStatus UInt32 | — |
LocalOnlyMapped UInt16 | — |
ErrorCode UInt32 | — |
References #
- Windows Forensic Artifacts https://github.com/Psmths/windows-forensic-artifacts/blob/main/network/evtx-2071-firewall-windows-11.md