WinSecWiki > Security Settings > Advanced Audit Policies > Policy Change > Filtering Platform Policy Change

Audit Filtering Platform Policy Change

This chatty category documents the current configuration of the Windows Filtering Platform (related for lower level than the Windows Firewall) whenever it starts as well as any changes to it's configuration. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event IDTitle
5440 The following callout was present when the Windows Filtering Platform Base Filtering Engine started
5441 The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
5442 The following provider was present when the Windows Filtering Platform Base Filtering Engine started.
5443 The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.
5444 The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.
5446 A Windows Filtering Platform callout has been changed.
5448 A Windows Filtering Platform provider has been changed.
5449 A Windows Filtering Platform provider context has been changed.
5450 A Windows Filtering Platform sub-layer has been changed.

Back to top

 

Upcoming Webinars
Additional Resources