> For the complete documentation index, see [llms.txt](https://psmths.gitbook.io/windows-forensics/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2052-firewall-windows-11.md).

# EventID 2052: Firewall Rule Deleted

This event indicates that a firewall rule has been deleted from the Windows Firewall. While currently unique to newer versions of Windows 11, it is functionally similar to:

{% content-ref url="/pages/rCK5NtuoMN6wlBEDyynu" %}
[EventID 2006: Firewall Rule Deleted](/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2006-firewall.md)
{% endcontent-ref %}