Windows Event ID 5027: Windows Firewall Service unable to retrieve security policy
Windows Security Event ID 5027 records that the Windows Firewall Service could not retrieve security policy from local storage and continued enforcing the current policy.
- Applicable version
- Windows Server 2008 and later; Windows Vista and later
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft states the event indicates low memory resources or Windows Firewall group policy registry corruption and often appears with Event ID 5028.
Key Fields
ErrorCode
The UInt32 error code for the retrieval failure. Microsoft examples show ErrorCode 2147942413.
Computer
The host whose firewall service could not read local policy. Internet-facing and remote-access systems should be prioritized.
Related Event 5028
Microsoft states 5027 typically occurs with 5028 when the service cannot parse the new security policy.
Common False Positives
- Low memory, registry corruption, or Group Policy misconfiguration can cause the error without malicious activity.
- Broken firewall policy deployments may generate 5027 across many hosts at the same time.
Related Events
MITRE ATT&CK Mapping
- T1686.003Disable or Modify System Firewall: Windows Host Firewall
Detection Notes
Microsoft says 5027 is usually configuration-related, so escalate to T1686.003 when threshold=1 occurrence is paired with firewall policy changes, 5028 parse failures, or 5030/5035 service-start failures on the same host. ErrorCode 2147942413 is the Microsoft example and should be retained for troubleshooting; the attack signal is that the Windows Firewall Service cannot retrieve local policy, potentially leaving an older or attacker-favorable policy enforced while remote access rules are changed elsewhere.
SecurityEvent
| where EventID == 5027
| project TimeGenerated, Computer, ErrorCodeindex=wineventlog EventCode=5027
| table _time, host, ErrorCodeThe Windows Firewall Service was unable to retrieve the security policy from the local storage.
ErrorCode: 2147942413
Computer: WEB01