Windows Security Log Event ID 5031

5031: The Windows Firewall Service blocked an application from accepting incoming connections on the network.

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

It's strange that this event refers to "Windows Firewall Service" when it is supposed to be a Filtering Platform Connection event.  Windows Firewall is built on top of the Windows Filtering Platform.  Perhaps it's because there is not Windows Firewall subcategory for connection type events.

At any rate as the description says, Windows Firewall prevented an application from accepting incoming connections due to absence of an appropriate Exception in the current profile's policy.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 5031

• Profiles:  %1
• Application:  %2

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Mini-Seminars Covering Event ID 5031 How to Monitor Network Activity with the Windows Security & Firewall Logs to Detect Inbound and Outbound Attacks

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy