Event Details
Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Policy Change->EventID 849 - An application was listed as an exception when the Windows Firewall started [Win 2003 / XP]
EventID 849 - An application was listed as an exception when the Windows Firewall started [Win 2003 / XP]
This event is generated during the Windows Firewall start-up and documents exception rule settings for each Windows Firewall application. One event is generated per each exception rule.

Find more information about this event on ultimatewindowssecurity.com.
Corresponding events on other OS versions:
Windows 2008
 Sample: 
Event Type:     Success Audit
Event Source:   Security
Event Category: Policy Change
Event ID:       849
Date:           12/16/2009
Time:           06:50:28
User:           NT AUTHORITY\SYSTEM
Computer:       DC1
Description:    
An application was listed as an exception when the Windows Firewall started.

Policy origin: Local Policy
Profile used: Standard
Name: Message Queuing
Path: C:\WINDOWS\system32\mqsvc.exe
State: Enabled
Scope: All subnets
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2003
Windows XP
Category Policy Change
Source Security
EventId 849
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
Source Name of an Application or System Service originating the event. Source Security
Type Warning, Information, Error, Success, Failure, etc. Type Success
User Domain\Account name of user/service/computer initiating event. User RESEARCH\Alebovsky
Computer Name of server workstation where event was logged. Computer DC1
EventID Numerical ID of event. Unique within one Event Source. EventId 576
Description The entire unparsed event message. Description Special privileges assigned to new logon.
Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
Category A name for a subclass of events within the same Event Source. Category Logon/Logoff
Policy origin Indicates whether Windows Firewall was getting its settings from Group Policy or the system's local policy. InsertionString1 Local Policy
Profile used Standard or Domain. Domain profile is applied when the computer is on its "home" network, Standard profile is applied when the computer is not connected to its "home" network, e.g. out travelling and connected to public internet via Wi-Fi. InsertionString2 Standard
Name Name of the exception. Normally displays the application name. InsertionString3 Message Queuing
Path Full system path to the application listed as an exception. InsertionString4 C:\WINDOWS\system32\mqsvc.exe
State State of the exception rule: Enabled or Disabled. InsertionString5 Enabled
Scope The IP Address and Subnet scopes to which traffic the exception rule applies. InsertionString6 All subnets
Comments
You must be logged in to comment