Event ID - 5025

Event Id	5025
Source	Microsoft-Windows-Security-Auditing
Description	The Windows Firewall Service has been stopped.
Event Information	According to Microsoft : Cause : This event is logged when Windows Firewall Service has been stopped. Resolution : Restart the Windows Firewall (MPSSVC) service If you manually stopped the Windows Firewall service, you can use the following procedure to restart it. To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority. To restart the firewall service: You can restart the service by using a command prompt or by using the Services MMC snap-in. Do one of the following: Start an administrative command prompt. Click Start , click All Programs , click Accessories , right-click Command Prompt , and then click Run as administrator . At that command prompt, run the command net start mpssvc . Click Start, type services.msc in the Start Search box, and then press ENTER. In the Name column of the Services snap-in, right-click Windows Firewall , and then click Start . If the attempt to restart only the service fails, then restart the computer. This forces all related and dependent services to restart. If the error persists after the computer restarts, then the executable files for the service or driver might be corrupted, and the operating system must be reinstalled. Verify : You can verify that the Windows Firewall service is running by using the Services Microsoft Management Console (MMC) snap-in or the net start command-line tool. To verify that the Windows Firewall service is running: Check the status by using the Services MMC snap-in To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority. Click Start , type services.msc in the Start Search box, and then press ENTER. In the Services MMC snap-in, find Windows Firewall , and then confirm that Started appears in the Status column . Check the status by using the net start command-line tool At a command prompt, type net start , and then verify that Windows Firewall is listed as one of the services currently running on the computer.
Reference Links	Event ID 5025 from Microsoft-Windows-Security-Auditing

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught