Event ID 2000 — Firewall Service and Driver Initialization

  • Article

Applies To: Windows Server 2008 R2

The Windows Firewall service (MpsSvc) and its supporting driver must be running to provide the core firewall functionality and to manage the firewall and connection security rules that define how the firewall operates. When appropriate auditing events are enabled (https://go.microsoft.com/fwlink/?linkid=92666), Windows reports successes and failures in starting the required software components, or when the components stop operating due to a failure.

Note: Because the Windows Firewall services applies Windows service hardening rules to standard Windows Networking services, Microsoft does not support stopping the Windows Firewall service. If you do not want to use Windows Firewall, turn the firewall features off without stopping the service.

Event Details

Product: Windows Operating System
ID: 2000
Source: Microsoft-Windows-Windows Firewall with Advanced Security
Version: 6.1
Symbolic Name: WFStartupConfigurationInfo
Message: The following settings were applied to the Windows Firewall at startup

%tCurrent Profile:%t%1
%tIPsec SA Idle time:%t%2
%tIPsec preshared key encoding:%t%3
%tIPsec Exempt:%t%4
%tIPsec CRL Check:%t%5
%tIPsec Through NAT:%t%6
%tPolicy Version Supported:%t%7
%tPolicy Version:%t%8
%tBinary Version Supported:%t%9
%tStateful FTP:%t%10
%tGroup Policy Applied:%t%11
%tRemote Machine Authorization List:%t%12
%tRemote User Authorization List:%t%13

Resolve

This is a normal condition. No further action is required.

Firewall Service and Driver Initialization

Windows Firewall with Advanced Security