WinSecWiki

WinSecWiki » Windows Security Settings » Local Policies » Audit Policy » Audit policy change » Filtering Platform Policy Change

Filtering Platform Policy Change

Expand / Collapse
 
     

Filtering Platform Policy Change


This chatty category documents the current configuration of the Windows Filtering Platform (related for lower level than the Windows Firewall) whenever it starts as well as any changes to it's configuration. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event IDTitle
5440 The following callout was present when the Windows Filtering Platform Base Filtering Engine started
5441 The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
5442 The following provider was present when the Windows Filtering Platform Base Filtering Engine started.
5443 The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.
5444 The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.
5446 A Windows Filtering Platform callout has been changed.
5448 A Windows Filtering Platform provider has been changed.
5449 A Windows Filtering Platform provider context has been changed.
5450 A Windows Filtering Platform sub-layer has been changed.

Add Your Comments


Name: *
Email Address:
Web Address:
Verification Code:
*
 

Details
Applies To: Vista, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8, Windows Server 2012
Article not rated yet.
Article has been viewed 2,702 times.
Options