SOC Event Lookup
Event ID 5030FirewallP2

Windows Event ID 5030: The Windows Firewall Service failed to start

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 5030 records that the Windows Firewall service failed to start or unexpectedly terminated.

Technical Metadata

Technical metadata for Event ID 5030
Event ID5030
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Failure
MITRE ATT&CKTA0005 Defense Evasion / T1562.004 Impair Defenses: Disable or Modify System Firewall
Key fields to watchError Code, Computer, EventID

Trigger Scenarios

Windows logs this event when the Windows Firewall service fails to start or unexpectedly terminates and includes an Error Code in the message text.

Key Fields

Error Code

The Microsoft schema exposes Error Code:%1 as the concrete reason text for the service failure. Preserve the exact value from the event for troubleshooting and escalation.

Computer

Identifies the host where firewall enforcement may be impaired.

EventID

Event 5030 is firewall-service specific; correlate it with 5035 for driver failure and system service-control events.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 5030
SecurityEvent
| where EventID == 5030
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 5030
index=wineventlog source="WinEventLog:Security" EventCode=5030
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 5030
dataset = microsoft_windows_raw
| filter edr_event_id = 5030
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 5030
title: Windows Security Event ID 5030
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5030
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1562.004Impair Defenses: Disable or Modify System Firewall

Detection Notes

T1562.004 Disable or Modify System Firewall is supported only when threshold=1 Event 5030 follows unauthorized firewall policy or service configuration changes. Preserve the concrete ErrorCode rendered from Error Code:%1, correlate 5035 and service-control telemetry, and do not invent a numeric code because Microsoft documents a message placeholder rather than one universal failure value.

Common False Positives

  • Microsoft notes software or operating-system issues can cause this event.
  • Policy corruption or missing dependencies may prevent other firewall events from being generated during failures.

Related Events

Sample Log

Sanitized event sample
EventID: 5030
Computer: HOST01
Error Code: 5

Frequently Asked Questions

What does Windows Event ID 5030 mean?

Event ID 5030 records that the Windows Firewall service failed to start and exposes the underlying error-code placeholder in the rendered event.

Does 5030 prove firewall tampering?

No. Corruption, operating-system faults, and software problems can also prevent startup; correlate service configuration, policy changes, and nearby firewall events.

How should the 5030 error be handled?

Preserve the rendered ErrorCode value and resolve it using the affected Windows build and service diagnostics rather than assigning a universal code.

Sources