5448: A Windows Filtering Platform provider has been changed
On this page
This event is logged when a WFP provider is added or there is a change to an existing provider. For more information on WFP and providers see 5442. In my testing this event is logged at startup for non persistent provider WFKMP which no doubt has something to do with Windows Firewall.
The user and logon session that performed the action.
A Windows Filtering Platform provider has been changed.
Subject:
Security ID: LOCAL SERVICE Account Name: NT AUTHORITY\LOCAL SERVICE
Process Information:
Process ID: 1364
Change Information:
Change Type: Add
Provider Information:
ID: {9250a3db-5929-4952-b834-e88709b0a35e} Name: WFKMP Type: Not persistent
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection
Go To Event ID:
Security Log Quick Reference Chart Download now!