Microsoft-Windows-Firewall-CPL

Event	Title	Channel	Sample	Rule
101	FwCplInitializeStart	Diagnostic	N	N
102	FwCplInitializeStop	Diagnostic	N	N
103	LoadExceptionsInitializeStart	Diagnostic	N	N
104	LoadExceptionsInitializeStop	Diagnostic	N	N
105	SetFirewallOnStart	Diagnostic	N	N
106	SetFirewallOnStop	Diagnostic	N	N
107	SetFirewallOffStart	Diagnostic	N	N
108	SetFirewallOffStop	Diagnostic	N	N
109	AddAppExceptionStart	Diagnostic	N	N
110	AddAppExceptionStop	Diagnostic	N	N
111	AddPortExceptionStart	Diagnostic	N	N
112	AddPortExceptionStop	Diagnostic	N	N
113	QUInitializeStart	Diagnostic	N	N
114	QUInitializeStop	Diagnostic	N	N
115	QUUnblockStart	Diagnostic	N	N
116	QUUnblockStop	Diagnostic	N	N
117	QUAskLaterStart	Diagnostic	N	N
118	QUAskLaterStop	Diagnostic	N	N

Event ID 101: FwCplInitializeStart

Channel: Diagnostic
Task: FwCplInitialize
Opcode: Start

Event ID 102: FwCplInitializeStop

Channel: Diagnostic
Task: FwCplInitialize
Opcode: Stop

Event ID 103: LoadExceptionsInitializeStart

Channel: Diagnostic
Task: LoadExceptionsInitialize
Opcode: Start

Event ID 104: LoadExceptionsInitializeStop

Channel: Diagnostic
Task: LoadExceptionsInitialize
Opcode: Stop

Event ID 105: SetFirewallOnStart

Channel: Diagnostic
Task: SetFirewallOn
Opcode: Start

Event ID 106: SetFirewallOnStop

Channel: Diagnostic
Task: SetFirewallOn
Opcode: Stop

Event ID 107: SetFirewallOffStart

Channel: Diagnostic
Task: SetFirewallOff
Opcode: Start

Event ID 108: SetFirewallOffStop

Channel: Diagnostic
Task: SetFirewallOff
Opcode: Stop

Event ID 109: AddAppExceptionStart

Channel: Diagnostic
Task: AddAppException
Opcode: Start

Event ID 110: AddAppExceptionStop

Channel: Diagnostic
Task: AddAppException
Opcode: Stop

Event ID 111: AddPortExceptionStart

Channel: Diagnostic
Task: AddPortException
Opcode: Start

Event ID 112: AddPortExceptionStop

Channel: Diagnostic
Task: AddPortException
Opcode: Stop

Event ID 113: QUInitializeStart

Channel: Diagnostic
Task: QUInitialize
Opcode: Start

Event ID 114: QUInitializeStop

Channel: Diagnostic
Task: QUInitialize
Opcode: Stop

Event ID 115: QUUnblockStart

Channel: Diagnostic
Task: QUUnblock
Opcode: Start

Event ID 116: QUUnblockStop

Channel: Diagnostic
Task: QUUnblock
Opcode: Stop

Event ID 117: QUAskLaterStart

Channel: Diagnostic
Task: QUAskLater
Opcode: Start

Event ID 118: QUAskLaterStop

Channel: Diagnostic
Task: QUAskLater
Opcode: Stop

Provenance

ETW provider GUID 546549be-9d63-46aa-9154-4f6eb9526378

Defined in FirewallControlPanel.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB