Event Details
Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Policy Change->EventID 850 - A port was listed as an exception when the Windows Firewall started [Win 2003 / XP]
EventID 850 - A port was listed as an exception when the Windows Firewall started [Win 2003 / XP]
This event is generated during the Windows Firewall start-up and documents exception rule settings for each Windows Firewall port/protocol. One event is generated per each exception rule.

Find more information about this event on ultimatewindowssecurity.com.
Corresponding events on other OS versions:
Windows 2008
Event Type:     Success Audit
Event Source:   Security
Event Category: Policy Change
Event ID:       850
Date:           12/16/2009
Time:           06:50:28
Computer:       DC1
A port was listed as an exception when the Windows Firewall started.

Policy origin: Local Policy
Profile used: Standard
Interface: All interfaces
Name: NetBIOS Name Service
Port number: 137
Protocol: UDP
State: Disabled
Scope: Local subnet only
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2003
Windows XP
Category Policy Change
Source Security
EventId 850
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
Source Name of an Application or System Service originating the event. Source Security
Type Warning, Information, Error, Success, Failure, etc. Type Success
User Domain\Account name of user/service/computer initiating event. User RESEARCH\Alebovsky
Computer Name of server workstation where event was logged. Computer DC1
EventID Numerical ID of event. Unique within one Event Source. EventId 576
Description The entire unparsed event message. Description Special privileges assigned to new logon.
Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
Category A name for a subclass of events within the same Event Source. Category Logon/Logoff
Policy origin Indicates whether Windows Firewall was getting its settings from Group Policy or the system's local policy. InsertionString1 Local Policy
Profile used Standard or Domain. Domain profile is applied when the computer is on its "home" network, Standard profile is applied when the computer is not connected to its "home" network, e.g. out travelling and connected to public internet via Wi-Fi. InsertionString2 Standard
Interface Displays Network Interface Cards this firewall setting is configured for. InsertionString3 All interfaces
Name Name of the service corresponding to the port number InsertionString4 NetBIOS Name Service
Port number Port number listed as an exception to allow traffic through InsertionString5 137
Protocol Protocol allowed: TCP or UDP InsertionString6 UDP
State State of the exception rule: Enabled or Disabled. InsertionString7 Disabled
Scope The IP Address and Subnet scopes to which traffic the exception rule applies. InsertionString8 Local subnet only
You must be logged in to comment