Windows Security Log Event ID 5448
| Operating Systems |
Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
|
Category
• Subcategory | Policy Change
• Filtering Platform Policy Change |
|
Type
|
Success
|
Corresponding events
in Windows
2003
and before |
|
5448: A Windows Filtering Platform provider has been changed
On this page
This event is logged when a WFP provider is added or there is a change to an existing provider.
For more information on WFP and providers see 5442.
In my testing this event is logged at startup for non persistent provider WFKMP which no doubt has something to do with Windows Firewall.
Free Security Log Resources by Randy
Subject:
The user and logon session that performed the action.
- Security ID: The SID of the account.
- Account Name: The account logon name with domain.
Process Information:
- Process ID is the process ID specified when the executable started as logged in 4688.
Change Information:
- Change Type: "Add" or "Delete"
Provider Information:
- Provider ID: Globally unique identifier of the provider
- Provider Name: name of the provider
- Type: "Not persistent" or "Persistent"
Setup PowerShell Audit Log Forwarding in 4 Minutes