Event ID 861 - The Windows Firewall has detected an application listening for incoming traffic
|Description||The Windows Firewall has detected an application listening for incoming traffic|
In Active Directory, when Windows firewall detecs any application listetning for incoming traffic, event ID 861 is logged.
This log data gives the following information:
- Process identifier
- User account
- User domain
- RPC server
- IP version
- IP protocol
- Port number
- User notified
Why event ID 861 needs to be monitored?
- Prevention of privilege abuse
- Detection of potential malicious activity
- Operational purposes like getting information on user activity like user attendance, peak logon times, etc.
- Compliance mandates
User management audit reports from ADAudit Plus help in monitoring user management actions in real-time and maintaining a record of actions done by users, administrators and technicians that helps in efficient functioning of an organization.
Event 861 applies to the following operating systems:
- Windows Server 2000
- Windows 2003 and XP
- Corresponding event ID for 861 in Windows Server 2008 and Vista are 5154 , 5155