windows-itpro-docs/windows/device-security/auditing/event-4948.md

title, description, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, author

title	description	ms.pagetype	ms.prod	ms.mktglfcycl	ms.sitesec	author
4948(S) A change has been made to Windows Firewall exception list. A rule was deleted. (Windows 10)	Describes security event 4948(S) A change has been made to Windows Firewall exception list. A rule was deleted.	security	w10	deploy	library	Mir0sh

4948(S): A change has been made to Windows Firewall exception list. A rule was deleted.

Applies to

• Windows 10
• Windows Server 2016

Subcategory: Audit MPSSVC Rule-Level Policy Change

Event Description:

This event generates when Windows Firewall rule was deleted.

This event doesn't generate when the rule was deleted via Group Policy.

Note

  For recommendations, see Security Monitoring Recommendations for this event.

Event XML:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
 <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
 <EventID>4948</EventID> 
 <Version>0</Version> 
 <Level>0</Level> 
 <Task>13571</Task> 
 <Opcode>0</Opcode> 
 <Keywords>0x8020000000000000</Keywords> 
 <TimeCreated SystemTime="2015-10-03T21:19:15.646187500Z" /> 
 <EventRecordID>1050934</EventRecordID> 
 <Correlation /> 
 <Execution ProcessID="500" ThreadID="528" /> 
 <Channel>Security</Channel> 
 <Computer>DC01.contoso.local</Computer> 
 <Security /> 
 </System>
- <EventData>
 <Data Name="ProfileChanged">All</Data> 
 <Data Name="RuleId">{F2649D59-1355-4E3C-B886-CDD08B683199}</Data> 
 <Data Name="RuleName">Allow All Rule</Data> 
 </EventData>
 </Event>

Required Server Roles: None.

Minimum OS Version: Windows Server 2008, Windows Vista.

Event Versions: 0.

Field Descriptions:

Profile Changed [Type = UnicodeString]: the list of profiles to which deleted rule was applied. Examples:

• All

• Domain,Public

• Domain,Private

• Private,Public

• Public

• Domain

• Private

Deleted Rule:

• Rule ID [Type = UnicodeString]: the unique identifier for deleted firewall rule.

  To see the unique ID of the rule you need to navigate to “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules” registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters:

• Rule Name [Type = UnicodeString]: the name of the rule which was deleted. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (wf.msc), check “Name” column:

Security Monitoring Recommendations

For 4948(S): A change has been made to Windows Firewall exception list. A rule was deleted.

• This event can be helpful in case you want to monitor all deletions of Firewall rules which were done locally.