Windows Security Log Event ID 5159

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Object Access
 • Filtering Platform Connection
Type Failure
Corresponding events
in Windows 2003
and before

5159: The Windows Filtering Platform has blocked a bind to a local port

On this page

This event is logged every time WFP prevents a client or server application binds to a port.  Binding is the first step in TCP or UDP communications.

Application Information:

  • Process ID:  process ID specified when the executable started as logged in 4688
  • Application Name: the program executable on this computer's side of the packet transmission

Free Security Log Resources by Randy

Description Fields in 5159

Application Information:

  •  Process ID:  %1
  •  Application Name: %2

Network Information:

  •  Source Address:  %3
  •  Source Port:  %4
  •  Protocol:  %5

Filter Information:

  •  Filter Run-Time ID: %6
  •  Layer Name:  %7
  •  Layer Run-Time ID: %8

Supercharger Free Edition


Examples of 5159

The Windows Filtering Platform has blocked a bind to a local port.

Application Information:

   Process ID:  592
   Application Name: \device\harddiskvolume1\windows\system32  \lsass.exe

Network Information:

   Source Address:  fe80::9516:1afb:3656:dab1
   Source Port:  389
   Protocol:  17

Filter Information:

   Filter Run-Time ID: 0
   Layer Name:  Resource Assignment
   Layer Run-Time ID: 38

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources