Getting alert, A change was made to the Windows Firewall exception list. A rule was deleted.

Question

|A change was made to the Windows Firewall exception list. A
rule was deleted.

Profile Changed: Domain,Private,Public

Deleted Rule:

Rule ID: {0C90097D-E267-4898-9903-5F0275D99816}

Rule Name:
@{Microsoft.MSPaint_6.2410.13017.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.MSPaint/resources/AppName}| | -------- | |A change was made to the Windows Firewall exception list. A rule was deleted. Profile Changed: Domain,Private,Public Deleted Rule: Rule ID: {0C90097D-E267-4898-9903-5F0275D99816} Rule Name: @{Microsoft.MSPaint_6.2410.13017.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.MSPaint/resources/AppName}|

Answer 1

Hello,

Thank you for posting in Microsoft Q&A.

Based on the description, I understand your question is related to Getting alert, A change was made to the Windows Firewall exception list. A rule was deleted.

You can use the Windows Event Viewer to look for events with IDs 2006 or 2033, which indicate firewall rule deletions. Also, event ID 4948 indicates a change in the Windows Firewall exception list, specifically a rule deletion.

Check if there is any Group Policy settings that might be causing the rule deletion.

Here is a reference link:

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4948

Have a nice day.

Best Regards,

Molly

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it