Windows Event ID 5030: The Windows Firewall Service failed to start
Windows Security Event ID 5030 records that the Windows Firewall service failed to start or unexpectedly terminated.
- Applicable version
- Windows Server 2008 R2 and later
- Last reviewed
- 2026-07-13
Trigger Scenarios
Windows logs this event when the Windows Firewall service fails to start or unexpectedly terminates and includes an Error Code in the message text.
Key Fields
Error Code
The Microsoft schema exposes Error Code:%1 as the concrete reason text for the service failure. Preserve the exact value from the event for troubleshooting and escalation.
Computer
Identifies the host where firewall enforcement may be impaired.
EventID
Event 5030 is firewall-service specific; correlate it with 5035 for driver failure and system service-control events.
Common False Positives
- Microsoft notes software or operating-system issues can cause this event.
- Policy corruption or missing dependencies may prevent other firewall events from being generated during failures.
Related Events
MITRE ATT&CK Mapping
- T1562.004Impair Defenses: Disable or Modify System Firewall
Detection Notes
Use threshold=1 on servers, domain controllers, and exposed workstations: Microsoft recommends monitoring 5030 because it can indicate malicious activity that corrupted the Windows Firewall Driver as well as software or OS issues. Preserve the exact Error Code value from Error Code:%1 and correlate with 5035, 5029, service-control events, and recent configuration changes. If the failure follows firewall policy tampering, map it to T1562.004 Disable or Modify System Firewall.
SecurityEvent
| where EventID == 5030
| project TimeGenerated, Computer, Accountindex=wineventlog EventCode=5030 | table _time, hostEventID: 5030
Computer: HOST01
Error Code: 5