Windows Security Log Event ID 5159
| Operating Systems |
Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
|
Category
• Subcategory | Object Access
• Filtering Platform Connection |
|
Type
|
Failure
|
Corresponding events
in Windows
2003
and before |
|
5159: The Windows Filtering Platform has blocked a bind to a local port
On this page
This event is logged every time WFP prevents a client or server application binds to a port. Binding is the first step in TCP or UDP communications.
Application Information:
- Process ID: process ID specified when the executable started as logged in 4688
- Application Name: the program executable on this computer's side of the packet transmission
Free Security Log Resources by Randy
Application Information:
- Process ID: %1
- Application Name: %2
Network Information:
- Source Address: %3
- Source Port: %4
- Protocol: %5
Filter Information:
- Filter Run-Time ID: %6
- Layer Name: %7
- Layer Run-Time ID: %8
Supercharger Enterprise
Load Balancing for Windows Event Collection
The Windows Filtering Platform has blocked a bind to a local port.
Application Information:
Process ID: 592
Application Name: \device\harddiskvolume1\windows\system32 \lsass.exe
Network Information:
Source Address: fe80::9516:1afb:3656:dab1
Source Port: 389
Protocol: 17
Filter Information:
Filter Run-Time ID: 0
Layer Name: Resource Assignment
Layer Run-Time ID: 38
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection