{
  "id": "5030",
  "source": "windows_security",
  "category": "Firewall",
  "name": "The Windows Firewall Service failed to start",
  "priority": "P2",
  "applicable_version": "Windows Server 2008 R2 and later",
  "last_reviewed": "2026-07-13",
  "definition": "Windows Security Event ID 5030 records that the Windows Firewall service failed to start or unexpectedly terminated.",
  "trigger_scenarios": "Windows logs this event when the Windows Firewall service fails to start or unexpectedly terminates and includes an Error Code in the message text.",
  "key_fields": [
    {
      "field": "Error Code",
      "explanation": "The Microsoft schema exposes Error Code:%1 as the concrete reason text for the service failure. Preserve the exact value from the event for troubleshooting and escalation."
    },
    {
      "field": "Computer",
      "explanation": "Identifies the host where firewall enforcement may be impaired."
    },
    {
      "field": "EventID",
      "explanation": "Event 5030 is firewall-service specific; correlate it with 5035 for driver failure and system service-control events."
    }
  ],
  "false_positives": [
    "Microsoft notes software or operating-system issues can cause this event.",
    "Policy corruption or missing dependencies may prevent other firewall events from being generated during failures."
  ],
  "related_event_ids": [
    "5035",
    "5029",
    "5028"
  ],
  "attck_mapping": [
    {
      "technique_id": "T1562.004",
      "technique_name": "Impair Defenses: Disable or Modify System Firewall"
    }
  ],
  "detection_notes": "Use threshold=1 on servers, domain controllers, and exposed workstations: Microsoft recommends monitoring 5030 because it can indicate malicious activity that corrupted the Windows Firewall Driver as well as software or OS issues. Preserve the exact Error Code value from Error Code:%1 and correlate with 5035, 5029, service-control events, and recent configuration changes. If the failure follows firewall policy tampering, map it to T1562.004 Disable or Modify System Firewall.",
  "kql_snippet": "SecurityEvent\n| where EventID == 5030\n| project TimeGenerated, Computer, Account",
  "spl_snippet": "index=wineventlog EventCode=5030 | table _time, host",
  "sample_log": "EventID: 5030\nComputer: HOST01\nError Code: 5",
  "source_url": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5030",
  "route": "/windows-events/5030/",
  "canonical_url": "https://soceventlookup.com/windows-events/5030/",
  "json_url": "/api/events/windows-security/5030.json"
}