WinSecWiki > Security Settings > Advanced Audit Policies > Policy Change > Other Policy Change Events

Audit Other Policy Change Events

So far I've only found one event in this category and it should clearly be in the Filtering Platform Policy Change subcategory instead. As with all subcategories you must use auditpol to enable to disable these events.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
5447	A Windows Filtering Platform filter has been changed.

Back to top

 

Upcoming Webinars AD Certificate Services: A Massive Chunk of Windows Security Functionality Finally Gets the Security Research It Deserves Linux Security: Locking Down Admin Access with SSH and Sudo Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps Patching 3rd Party Apps on PCs Managed by Intune

Additional Resources