windows-itpro-docs/windows/device-security/auditing/event-5033.md

title, description, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, author

title	description	ms.pagetype	ms.prod	ms.mktglfcycl	ms.sitesec	author
5033(S) The Windows Firewall Driver has started successfully. (Windows 10)	Describes security event 5033(S) The Windows Firewall Driver has started successfully.	security	w10	deploy	library	Mir0sh

5033(S): The Windows Firewall Driver has started successfully.

Applies to

• Windows 10
• Windows Server 2016

Subcategory: Audit Other System Events

Event Description:

This event generates when Windows Firewall driver (Windows Firewall Authorization Driver service) has started successfully.

This event is typically logged during operating system startup process.

Note

  For recommendations, see Security Monitoring Recommendations for this event.

Event XML:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
 <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
 <EventID>5033</EventID> 
 <Version>0</Version> 
 <Level>0</Level> 
 <Task>12292</Task> 
 <Opcode>0</Opcode> 
 <Keywords>0x8020000000000000</Keywords> 
 <TimeCreated SystemTime="2015-10-09T03:22:53.526024800Z" /> 
 <EventRecordID>1101612</EventRecordID> 
 <Correlation /> 
 <Execution ProcessID="4" ThreadID="148" /> 
 <Channel>Security</Channel> 
 <Computer>DC01.contoso.local</Computer> 
 <Security /> 
 </System>
 <EventData /> 
 </Event>

Required Server Roles: None.

Minimum OS Version: Windows Server 2008, Windows Vista.

Event Versions: 0.

Security Monitoring Recommendations

For 5033(S): The Windows Firewall Driver has started successfully.

• Typically this event has an informational purpose. It’s logged during operating system startup process.

• You should not see this event after system startup, so we recommend that you monitor it when it occurs outside the system startup process.