Event ID 5031 — Firewall Service Block Notifications

  • Article

Applies To: Windows Server 2008 R2

Windows Firewall with Advanced Security can be configured to notify the user when an application is blocked by the firewall, and ask if the application should continue to be blocked in the future. This notification is turned on by default in Windows Vista, and turned off by default in Windows Server 2008.

When appropriate auditing events are enabled (https://go.microsoft.com/fwlink/?linkid=92666), Windows reports when applications are blocked by the firewall.

Event Details

Product: Windows Operating System
ID: 5031
Source: Microsoft-Windows-Security-Auditing
Version: 6.1
Symbolic Name: SE_AUDITID_ETW_FIREWALL_APP_BLOCKED_FROM_LISTENING
Message: The Windows Firewall Service blocked an application from accepting incoming connections on the network.

Profiles:%t%t%1
Application:%t%t%2

Resolve

This is a normal condition. No further action is required.

Firewall Service Block Notifications

Windows Firewall with Advanced Security