Windows Event ID 5035: The Windows Firewall Driver failed to start
Windows Security Event ID 5035 records that the Windows Firewall Driver failed to start or unexpectedly terminated.
- Applicable version
- Windows Server 2008 R2 and later
- Last reviewed
- 2026-07-13
Trigger Scenarios
Windows logs this event when the Windows Firewall driver fails to start or unexpectedly terminates and includes an Error Code in the message text.
Key Fields
Error Code
The Microsoft schema exposes Error Code:%1 as the concrete driver-failure reason. Preserve the exact value from the event.
Computer
Identifies the host where packet filtering may be impaired before or during service startup.
EventID
Event 5035 is firewall-driver specific; correlate it with 5030 for service failure and boot/service events.
Common False Positives
- Microsoft notes software or operating-system issues can cause this event.
- Driver corruption or dependency failures during maintenance can create non-malicious failures.
Related Events
MITRE ATT&CK Mapping
- T1562.004Impair Defenses: Disable or Modify System Firewall
Detection Notes
Use threshold=1 on high-value assets: Microsoft recommends monitoring 5035 because it can indicate malicious activity that corrupted the Windows Firewall Driver. Preserve the exact Error Code value from Error Code:%1 and correlate with 5030, boot-time service failures, driver integrity events, and recent firewall policy changes. If the driver was disabled or corrupted to reduce network filtering, map the chain to T1562.004 Disable or Modify System Firewall.
SecurityEvent
| where EventID == 5035
| project TimeGenerated, Computer, Accountindex=wineventlog EventCode=5035 | table _time, hostEventID: 5035
Computer: HOST01
Error Code: 5