deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-23 02:37:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
windows-itpro-docs/windows/device-security/auditing/event-4954.md
Brian Lich 33c3fb2e74 New TOC for docs.microsoft.com
2017-04-19 14:12:47 -07:00

2.2 KiB
Raw Blame History

title, description, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, author
title description ms.pagetype ms.prod ms.mktglfcycl ms.sitesec author
4954(S) Windows Firewall Group Policy settings have changed. The new settings have been applied. (Windows 10) Describes security event 4954(S) Windows Firewall Group Policy settings have changed. The new settings have been applied. security w10 deploy library Mir0sh

4954(S): Windows Firewall Group Policy settings have changed. The new settings have been applied.

Applies to

  • Windows 10
  • Windows Server 2016
Event 4954 illustration

Subcategory: Audit MPSSVC Rule-Level Policy Change

Event Description:

This event generates every time Windows Firewall group policy is changed, locally or from Active Directory Group Policy.

This event generates every time local Group Policy is refreshed, even if no Windows Firewall settings were modified or presented.

Note

  For recommendations, see Security Monitoring Recommendations for this event.


Event XML:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
 <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
 <EventID>4954</EventID> 
 <Version>0</Version> 
 <Level>0</Level> 
 <Task>13571</Task> 
 <Opcode>0</Opcode> 
 <Keywords>0x8020000000000000</Keywords> 
 <TimeCreated SystemTime="2015-10-02T23:13:14.527924800Z" /> 
 <EventRecordID>1049893</EventRecordID> 
 <Correlation /> 
 <Execution ProcessID="500" ThreadID="2284" /> 
 <Channel>Security</Channel> 
 <Computer>DC01.contoso.local</Computer> 
 <Security /> 
 </System>
 <EventData /> 
 </Event>

Required Server Roles: None.

Minimum OS Version: Windows Server 2008, Windows Vista.

Event Versions: 0.

Security Monitoring Recommendations

For 4954(S): Windows Firewall Group Policy settings have changed. The new settings have been applied.

  • Unfortunately this event generates every time local Group Policy is refreshed and does not indicate that settings really were modified. Typically this event can be ignored.