Windows Event ID 5028: Windows Firewall Service unable to parse new security policy
Windows Security Event ID 5028 records that the Windows Firewall Service could not parse a new security policy and continued with the currently enforced policy.
- Applicable version
- Windows Server 2008 and later; Windows Vista and later
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft states the event can indicate low memory or Windows Firewall group policy registry corruption, and it typically occurs with Event ID 5027.
Key Fields
ErrorCode
The UInt32 error code for the parse failure. Microsoft examples show ErrorCode 2147942413.
Computer
The host that failed to parse firewall policy. Investigate exposure changes if the host provides remote services.
Policy state
The event explicitly says the service continues with currently enforced policy; determine whether the intended new policy was supposed to restrict inbound or outbound access.
Common False Positives
- Malformed firewall GPOs or registry corruption can produce the event during normal administration.
- Low-memory conditions can make policy parsing fail without a deliberate firewall change.
Related Events
MITRE ATT&CK Mapping
- T1686.003Disable or Modify System Firewall: Windows Host Firewall
Detection Notes
Escalate 5028 to T1686.003 when threshold=1 failure coincides with netsh, PowerShell firewall cmdlets, registry policy changes, or 5027 on the same host. ErrorCode 2147942413 is Microsoft’s documented example for the policy parse failure; the security question is whether a new restrictive firewall policy failed to apply, leaving remote-service ports exposed under the previously enforced policy.
SecurityEvent
| where EventID == 5028
| project TimeGenerated, Computer, ErrorCodeindex=wineventlog EventCode=5028
| table _time, host, ErrorCodeThe Windows Firewall Service was unable to parse the new security policy.
ErrorCode: 2147942413
Computer: WEB01