Event ID 5027-The Windows Firewall Service was unable to retrieve the security policy from the local storage.
|Description||The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue to enforce the current policy.|
|Subcategory||Other system events|
Reasons to monitor event:
- This event could be caused by low memory resources or due to Windows Firewall Group registry corruption.
- Usually, this event could indicate that the firewall could not start.
- This event can be a sign of software or operating system issues, Windows Firewall registry errors or corruption, or Group Policy setting misconfiguration. We recommend monitoring this event and investigating the reason for the condition. Typically this event indicates configuration issues, not security issues.
It typically occurs with Event 5028 : The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.
Event 5027 applies to the following operating systems:
- Windows Server 2008 R2 and 7
- Windows Server 2012 R2 and 8.1
- Windows Server 2016 and 10
Explore Active Directory auditing and reporting with ADAudit Plus.
- Related Products
- ADManager Plus Active Directory Management & Reporting
- ADAudit Plus Real-time Active Directory Auditing and UBA
- EventLog Analyzer Real-time Log Analysis & Reporting
- ADSelfService Plus Self-Service Password Management
- AD360 Integrated Identity & Access Management
- Log360 Comprehensive SIEM and UEBA
- AD Free Tools Active Directory FREE Tools