5024 The Windows Firewall Service has started successfully
Written when the Windows Firewall Service starts successfully. It is a reference event indicating that defenses have begun running.
Overview
The subcategory is Audit Other System Events. It is generated when the firewall service (MPSSVC) starts successfully. Paired with stop 5025, it captures the firewall’s uptime window.
How it is triggered
- When the firewall comes up successfully at system startup or service restart.
Security review points
- It is usable to confirm the firewall is running. Check whether a restart 5024 follows a stop 5025, and whether a start failure 5030 appears.
- If unexpected restarts are frequent, also consider the slight possibility of operations aiming to destabilize the firewall.
Notes for log review
- It is a reference event that appears normally at startup. Look at whether stop/start pairs are matched rather than the count.
- Evaluate service health together with start failure 5030 and settings-load failures 5027 to 5029.
Key fields
| Field | Meaning |
|---|---|
Computer | The host |
TimeCreated | The startup time |