WinSecWiki > Security Settings > Local Policies > Audit Policy > Policy Change > Filtering Platform

Filtering Platform Policy Change

This chatty category documents the current configuration of the Windows Filtering Platform (related for lower level than the Windows Firewall) whenever it starts as well as any changes to it's configuration. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 and later can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
5440	The following callout was present when the Windows Filtering Platform Base Filtering Engine started
5441	The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
5442	The following provider was present when the Windows Filtering Platform Base Filtering Engine started.
5443	The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.
5444	The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.
5446	A Windows Filtering Platform callout has been changed.
5448	A Windows Filtering Platform provider has been changed.
5449	A Windows Filtering Platform provider context has been changed.
5450	A Windows Filtering Platform sub-layer has been changed.

Back to top

 

Upcoming Webinars

Additional Resources