SOLVED: How to Disable Event 5156: Windows Filtering Platform has permitted a connection

If you are like me, your 125MB Windows Server 2008 R2 logs are jammed with “Event 5156: Windows Filtering Platform has permitted a connection”:

Event 5156: Windows Filtering Platform has permitted a connection
Event 5156: Windows Filtering Platform has permitted a connection

I could not figure out how to disable this because in LOCAL SECURITY POLICY it was greyed out, which I know means it is controlled by a Group Policy:Event 5156: Windows Filtering Platform has permitted a connection Local Policy

I was working on the DEFAULT DOMAIN POLICY which was not correcting the problem. The solution was to change the DEFAULT DOMAIN CONTROLLER POLICY > POLICIES > WINDOWS SETTINGS > SECURITY SETTINGS > AUDIT POLICY > AUDIT OBJECT ACCESS settings:

event-5156-The-Windows-Filtering-Platform-has-permitted-a-connection-domain-controller-gp
event-5156-The-Windows-Filtering-Platform-has-permitted-a-connection-domain-controller-gp

 

Share This With Your Friends Now:
Facebooktwittergoogle_plusredditpinterestlinkedin