{"id":1460,"date":"2016-10-28T17:15:29","date_gmt":"2016-10-29T00:15:29","guid":{"rendered":"http:\/\/jim-zimmerman.com\/?p=1460"},"modified":"2016-10-28T17:15:29","modified_gmt":"2016-10-29T00:15:29","slug":"auditpol-windows-filtering-platform-event-id-5157","status":"publish","type":"post","link":"https:\/\/jim-zimmerman.com\/?p=1460","title":{"rendered":"Auditpol – Windows Filtering Platform – Event ID: 5157"},"content":{"rendered":"

Enough is enough. I’ll turn it on when I need it or have infinitely resources to manage the logs when I have Filtering Platform logging enabled. In my case, I was getting a lot messages for event ID 5157 (“The Windows Filtering Platform has blocked a connection.”). For now, how do you turn this off in Windows Server 2012 R2?<\/p>\n

To list all the categories:<\/p>\n

C:\\>auditpol \/list \/category
\nCategory\/Subcategory
\nAccount Logon
\nAccount Management
\nDetailed Tracking
\nDS Access
\nLogon\/Logoff
\nObject Access
\nPolicy Change
\nPrivilege Use
\nSystem<\/p><\/blockquote>\n

To get a list of any sub-categories for a category:<\/p>\n

auditpol \/get \/category:”Account Logon”
\nauditpol \/get \/category:”Account Management”
\nauditpol \/get \/category:”Detailed Tracking”
\nauditpol \/get \/category:”DS Access”
\nauditpol \/get \/category:”Logon\/Logoff”
\nauditpol \/get \/category:”Object Access”
\nauditpol \/get \/category:”Policy Change”
\nauditpol \/get \/category:”Privilege Use”
\nauditpol \/get \/category:”System”<\/p><\/blockquote>\n

I have picked on the sub-categories under the “Object Access” category, because that is where the Filtering Platform settings exist. To see the current settings for a sub-category:<\/p>\n

auditpol \/get \/subcategory:”Filtering Platform Packet Drop”
\nauditpol \/get \/subcategory:”Filtering Platform Connection”
\nauditpol \/get \/subcategory:”IPsec Driver”
\nauditpol \/get \/subcategory:”IPsec Main Mode”
\nauditpol \/get \/subcategory:”IPsec Quick Mode”
\nauditpol \/get \/subcategory:”IPsec Extended Mode”<\/p><\/blockquote>\n

Example:<\/p>\n

C:\\>auditpol \/get \/subcategory:”Filtering Platform Connection”
\nSystem audit policy
\nCategory\/Subcategory Setting
\nObject Access
\n Filtering Platform Connection Success and Failure<\/p><\/blockquote>\n

To disable all audit logging for some sub-categories:<\/p>\n

auditpol \/set \/subcategory:”Filtering Platform Packet Drop” \/success:disable \/failure:disable
\nauditpol \/set \/subcategory:”Filtering Platform Connection” \/success:disable \/failure:disable
\nauditpol \/set \/subcategory:”IPsec Driver” \/success:disable \/failure:disable
\nauditpol \/set \/subcategory:”IPsec Main Mode” \/success:disable \/failure:disable
\nauditpol \/set \/subcategory:”IPsec Quick Mode” \/success:disable \/failure:disable
\nauditpol \/set \/subcategory:”IPsec Extended Mode” \/success:disable \/failure:disable<\/p><\/blockquote>\n

C:\\>auditpol \/get \/subcategory:”Filtering Platform Connection”
\nSystem audit policy
\nCategory\/Subcategory Setting
\nObject Access
\n Filtering Platform Connection No Auditing<\/p><\/blockquote>\n

Or to enable all audit logging for some sub-categories:<\/p>\n

auditpol \/set \/subcategory:”Filtering Platform Packet Drop” \/success:enable \/failure:enable
\nauditpol \/set \/subcategory:”Filtering Platform Connection” \/success:enable \/failure:enable
\nauditpol \/set \/subcategory:”IPsec Driver” \/success:enable \/failure:enable
\nauditpol \/set \/subcategory:”IPsec Main Mode” \/success:enable \/failure:enable
\nauditpol \/set \/subcategory:”IPsec Quick Mode” \/success:enable \/failure:enable
\nauditpol \/set \/subcategory:”IPsec Extended Mode” \/success:enable \/failure:enable<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

Enough is enough. I’ll turn it on when I need it or have infinitely resources to manage the logs when I have Filtering Platform logging enabled. In my case, I was getting a lot messages for event ID 5157 (“The Windows Filtering Platform has blocked a connection.”). For now, how do you turn this off [&hellip<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[436,435,437,36],"class_list":["post-1460","post","type-post","status-publish","format-standard","hentry","category-documentation","tag-436","tag-audit","tag-filter","tag-windows"],"share_on_mastodon":{"url":"","error":""},"_links":{"self":[{"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/posts\/1460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1460"}],"version-history":[{"count":2,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/posts\/1460\/revisions"}],"predecessor-version":[{"id":1462,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/posts\/1460\/revisions\/1462"}],"wp:attachment":[{"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}