Windows System Event: 5027

Active Directory Auditing Tool

The Who, Where and When information is very important for an administrator to have complete knowledge of all activities that occur on their Active Directory. This helps them identify any desired / undesired activity happening. ADAudit Plus assists an administrator with this information in the form of reports. In real-time, ensure critical resources in the network like the Domain Controllers are audited, monitored and reported with the entire information on AD objects - Users, Groups, GPO, Computer, OU, DNS, AD Schema and Configuration changes with 200+ detailed event specific GUI reports and email alerts.

System Event » Windows System Event: 5027

Event ID 5027-The Windows Firewall Service was unable to retrieve the security policy from the local storage.

Description The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue to enforce the current policy.
Category System
Subcategory Other system events

Reasons to monitor event:

  • This event could be caused by low memory resources or due to Windows Firewall Group registry corruption.
  • Usually, this event could indicate that the firewall could not start.
  • This event can be a sign of software or operating system issues, Windows Firewall registry errors or corruption, or Group Policy setting misconfiguration. We recommend monitoring this event and investigating the reason for the condition. Typically this event indicates configuration issues, not security issues.

Related events:

It typically occurs with Event 5028 : The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.

Event 5027 applies to the following operating systems:

  • Windows Server 2008 R2 and 7
  • Windows Server 2012 R2 and 8.1
  • Windows Server 2016 and 10