WinSecWiki > Security Settings > Local Policies > Audit Policy > Policy Change > Other Policy Change Events

Other Policy Change Events

So far I've only found one event in this category and it should clearly be in the Filtering Platform Policy Change subcategory instead. As with all subcategories you must use auditpol to enable to disable these events.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
5447	A Windows Filtering Platform filter has been changed.

Back to top

 

Upcoming Webinars Live, Hands-on Deep-Dive into LLM Hacking: Prompt Injection, Model Context Protocol and Skills AD Certificate Services: A Massive Chunk of Windows Security Functionality Finally Gets the Security Research It Deserves Linux Security: Locking Down Admin Access with SSH and Sudo Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps

Additional Resources