Windows Firewall Service Stopped Event Audit
Operating System SecurityFind All Windows Events for Windows Firewalls Stopped
The Windows event log contains masses of valuable information. Using the event log scanning, you can detect when the Windows firewall service has been stopped resulting in a security risk. The report below provides an overview of all events with ID 5025 that have been generated in the last 7 days. If you want more info on how you can keep an eye on the Windows firewall status, head over to the Pro tips #15 blog post.
Windows Firewall Service Stopped In The Last 7 Days
Select Top 1000000 tblAssets.AssetID, tblAssets.AssetName, tblAssets.Domain, tblAssets.Username, tblAssets.Userdomain, Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon, tblAssets.IPAddress, tsysIPLocations.IPLocation, tblAssetCustom.Manufacturer, tblAssetCustom.Model, tsysOS.OSname As OS, tblNtlog.Eventcode, tblNtlogSource.Sourcename, tblNtlogMessage.Message, tblNtlog.TimeGenerated, Case When tblErrors.ErrorText Is Not Null Or tblErrors.ErrorText != '' Then 'Scanning Error: ' + tsysasseterrortypes.ErrorMsg Else '' End As ScanningErrors, tblAssets.Lastseen, tblAssets.Lasttried From tblAssets Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype Inner Join tsysIPLocations On tsysIPLocations.LocationID = tblAssets.LocationID Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID Inner Join tblNtlogSource On tblNtlogSource.SourcenameID = tblNtlog.SourcenameID Inner Join tblState On tblState.State = tblAssetCustom.State Left Join tsysOS On tsysOS.OScode = tblAssets.OScode Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID, Max(tblErrors.Teller) As ErrorID From tblErrors Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID = ScanningError.ID Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype = tblErrors.ErrorType Where tblNtlog.Eventcode = 5025 And tblAssetCustom.State = 1 and tblNtlog.TimeGenerated > Getdate() -7 Order By tblAssets.Domain, tblAssets.AssetName