Event ID 5050 — Firewall Service API

Applies To: Windows Server 2008

Windows can detect when an application attempts to use an obsolete application programming interface (API) to disable the firewall.

When appropriate auditing events are enabled (https://go.microsoft.com/fwlink/?linkid=92666), Windows reports when applications attempt to use obsolete API calls.

Event Details

Product: Windows Operating System
ID: 5050
Source: Microsoft-Windows-Security-Auditing
Version: 6.0
Message: An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE) interface was rejected because this API is not supported on Windows Vista. This has most likely occurred due to a program which is incompatible with Windows Vista. Please contact the program's manufacturer to make sure you have a Windows Vista compatible program version.

Error Code:%t%tE_NOTIMPL
Caller Process Name:%t%t%1
Process Id:%t%t%2


Notify application vendor of incompatibility with Windows Firewall

In Windows Vista and Windows Server 2008, some Windows Firewall application programming interface (API) calls, such as one used to programmatically disable Windows Firewall, have been removed from the operating system for security reasons. Because these APIs are not supported, the firewall service logs an event whenever an application attempts to use them, and then ends the call with a failure code. This might cause the application to fail at runtime.

Check with your application vendor to see if a newer version of the application that is compatible with Windows Vista or Windows Server 2008 is available.


Contact your vendor for the latest version of the application and ensure that it is compatible with Windows Vista or Windows Server 2008. Applications made for earlier versions of Windows might use application programming interface (API) calls that are no longer supported for security reasons.

Firewall Service API

Windows Firewall with Advanced Security