SOC Event Lookup
Event ID 5028FirewallP3

Windows Event ID 5028: Windows Firewall Service unable to parse new security policy

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 5028 records that the Windows Firewall Service could not parse a new security policy and continued with the currently enforced policy.

Technical Metadata

Technical metadata for Event ID 5028
Event ID5028
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0112 Defense Impairment / T1686.003 Disable or Modify System Firewall: Windows Host Firewall
Key fields to watchErrorCode, Computer, Policy state

Trigger Scenarios

Microsoft states the event can indicate low memory or Windows Firewall group policy registry corruption, and it typically occurs with Event ID 5027.

Key Fields

ErrorCode

The UInt32 error code for the parse failure. Microsoft examples show ErrorCode 2147942413.

Computer

The host that failed to parse firewall policy. Investigate exposure changes if the host provides remote services.

Policy state

The event explicitly says the service continues with currently enforced policy; determine whether the intended new policy was supposed to restrict inbound or outbound access.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 5028
SecurityEvent
| where EventID == 5028
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 5028
index=wineventlog source="WinEventLog:Security" EventCode=5028
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 5028
dataset = microsoft_windows_raw
| filter edr_event_id = 5028
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 5028
title: Windows Security Event ID 5028
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5028
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
ErrorCode2147942413The error-code example in Microsoft's event reference; actual deployments can report other codes.Interpret ErrorCode with the complete event and correlated activity; this value alone is not proof of compromise. Source
EventID5028Windows Firewall Service could not parse a new security policy.Interpret EventID with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1686.003Disable or Modify System Firewall: Windows Host Firewall

Detection Notes

Escalate 5028 to T1686.003 when threshold=1 failure coincides with netsh, PowerShell firewall cmdlets, registry policy changes, or 5027 on the same host. ErrorCode 2147942413 is Microsoft’s documented example for the policy parse failure; the security question is whether a new restrictive firewall policy failed to apply, leaving remote-service ports exposed under the previously enforced policy.

Common False Positives

  • Malformed firewall GPOs or registry corruption can produce the event during normal administration.
  • Low-memory conditions can make policy parsing fail without a deliberate firewall change.

Related Events

Sample Log

Sanitized event sample
The Windows Firewall Service was unable to parse the new security policy.
ErrorCode: 2147942413
Computer: WEB01

Frequently Asked Questions

What does Windows Event ID 5028 mean?

Windows Firewall Service could not parse a new security policy.

Does Event ID 5028 always indicate malicious activity?

No. Invalid or incompatible administrative policy can cause it.

How should Event ID 5028 be investigated?

Decode ErrorCode, compare the proposed and active policies, and correlate with policy-editing commands and related firewall failures.

Sources