# Event ID 4956: Windows Firewall has changed the active profile.

## Description

This event generates when Windows Firewall has changed the active profile.

## Data Dictionary

|Standard Name|Field Name|Type|Description|Sample Value|
|---|---|---|---|---|
|active_profile|ActiveProfile|string|the name of the new active profile.|Domain|

## Reference

[MS Source](https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/threat-protection/auditing/event-4956.md)