I am on vacation now. I don't remember the event source. But I have a record of the event messages. System Event: 7040 The Start type of Microsoft Firewall service was changed from auto start to disable. 7035 The Microsoft Firewall service was successfully sent a stop control. 7036 The Microsoft Firewall service entered the stopped state. Application Event: 14182 The Firewall service was stopped gracefully.