5024 Security log · Windows Firewall info severity low volume

Windows Event ID 5024 — The Windows Firewall Service has started successfully

Windows Firewall service started.

Why event 5024 matters

Normal boot-time event. Unexpected starts after a stop (5025) may indicate firewall was disabled and re-enabled.

How to detect it

Use with 5025 for firewall availability timeline.

Log source
Security
Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 5024   // The Windows Firewall Service has started successfully
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=5024
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The Windows Firewall Service has started successfully — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 5024 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Windows Firewall events

4944 The following policy was active when the Windows Firewall started 4946 A change has been made to Windows Firewall exception list — a rule was added 4947 A change has been made to Windows Firewall exception list — a rule was modified 4948 A change has been made to Windows Firewall exception list — a rule was deleted 4950 A Windows Firewall setting has changed 4957 Windows Firewall did not apply the following rule 5025 The Windows Firewall Service has been stopped 5031 Windows Firewall blocked an application from accepting incoming connections

Frequently asked questions

What is Windows Event ID 5024?

The Windows Firewall Service has started successfully. Windows Firewall service started.

Which log records event 5024?

Event 5024 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).

How do you detect activity around event 5024?

Use with 5025 for firewall availability timeline.