Windows Security Log Event ID 5446

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Policy Change
 • Filtering Platform Policy Change
Type Success
Corresponding events
in Windows 2003
and before

5446: A Windows Filtering Platform callout has been changed

On this page

A WFP callout is aet of functions in a driver used for specialized filtering. Callouts can block, permit, modify and secure network traffic.  For more information on WFP and providers see 5442.

This event is logged whenever a callout is added or deleted.

Free Security Log Resources by Randy

Description Fields in 5446


The user and logon session that performed the action.

  • Security ID:  The SID of the account.
  • Account Name: The account logon name with domain.

Process Information:

  • Process ID is the process ID specified when the executable started as logged in 4688.

Provider Information:

  • Provider ID: Globally unique identifier of the provider
  • Provider Name: name of the provider

Change Information: 

  • Change Type: "Add" or "Delete"

Callout Information:

  • ID:  GUID of the callout
  • Name:  call out name
  • Type:  "Not persistent" or "Persistent"
  • Run-Time ID:

Layer Information:

  • ID:  GUID of the layer
  • Name:  Layer name
  • Run-Time ID:

Supercharger Free Edition


Examples of 5446

A Windows Filtering Platform callout has been changed.


   Security ID:  LOCAL SERVICE

Process Information:

   Process ID: 1364

Provider Information:

   ID:  {9250a3db-5929-4952-b834-e88709b0a35e}
   Name:  WFKMP

Change Information:

   Change Type: Add
Callout Information:

   ID:  {c3dbed20-0bb6-4bf3-828d-96732e1e051a}
   Name:  Windows Firewall: callout
   Type:  Not persistent
   Run-Time ID: 279

Layer Information:

   ID:  {fa45fe2f-3cba-4427-87fc-57b9a4b10d00}
   Name:  Datagram Data v6 Layer
   Run-Time ID: 26

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources