Платформа фильтрации windows разрешила подключение 5156

When you open the Security Event log, the log may contain many “Filtering Platform Connection” events. The event ID of these entries maybe 5156 or 5158. The security log may record close to 100 events per minute, containing the event ID 5156 or 5158. This causes the security event log to become full very quickly.

Sample Event ID 5156 entry

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          7/19/2022 11:27:37 AM
Event ID:      5156
Task Category: Filtering Platform Connection
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      OptiPlex-9020
Description:
The Windows Filtering Platform has permitted a connection.

Application Information:
	Process ID:		2592
	Application Name:	\device\harddiskvolume2\program files (x86)\microsoft\edge\application\msedge.exe

Network Information:
	Direction:		Outbound
	Source Address:		192.168.0.101
	Source Port:		63386
	Destination Address:	239.255.255.250
	Destination Port:		1900
	Protocol:		17

Filter Information:
	Filter Run-Time ID:	144025
	Layer Name:		Connect
	Layer Run-Time ID:	48

Sample Event ID 5158 entry

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          7/19/2022 11:27:51 AM
Event ID:      5158
Task Category: Filtering Platform Connection
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      OptiPlex-9020
Description:
The Windows Filtering Platform has permitted a bind to a local port.

Application Information:
	Process ID:		7612
	Application Name:	\device\harddiskvolume2\program files (x86)\google\chrome\application\chrome.exe

Network Information:
	Source Address:		::
	Source Port:		60420
	Protocol:		17

Filter Information:
	Filter Run-Time ID:	145279
	Layer Name:		Resource Assignment
	Layer Run-Time ID:	38

The security event log getting bombarded with 100 events per minute is never a good thing. Not only it’s an unnecessary disk I/O operation, but it also FIFOs out other vital security log data.

Cause

Windows Filtering Platform (WFP) is a set of API and system services that provide a platform for creating network filtering applications. Windows Firewall is based on WFP.

On a standard Windows installation, the Success/Failure entries for “Filtering Platform Connection” aren’t audited/logged. However, third-party software may have enabled auditing for this category. If auditing is enabled, Windows Filtering Platform generates the events 5156 and 5158 when it has allowed a connection. Event ID 5157 is written when WFP has blocked a connection.

For more information on WFP auditing, see this Microsoft article.

This article tells you how to prevent a spate of “Filtering Platform Connection” events from being written to the Security event Log every minute.

Solution

To stop Windows Filtering Platform from (“Filtering Platform Connection”) from logging Success and Failure events (5156, 5157, and 5158) in the Security event log, follow these steps:

Disable “Filtering Platform Connection” Success Audit

First, open an admin Command Prompt.

Type the following command and press Enter:

auditpol /set /subcategory:"{0CCE9226-69AE-11D9-BED3-505054503030}" /success:disable /failure:disable

That’s it. The Security event log should no longer get bombarded with events 5156, 5157, or 5158 from now on.

auditpol /get /subcategory:"{0CCE9226-69AE-11D9-BED3-505054503030}"

System audit policy
Category/Subcategory                      Setting
Object Access
  Filtering Platform Connection           No Auditing

The security event log will have recorded the following event after the audit policy change:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          7/19/2022 12:50:01 PM
Event ID:      4719
Task Category: Audit Policy Change
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      OptiPlex-9020
Description:
System audit policy was changed.

Subject:
	Security ID:		OPTIPLEX-9020\ramesh
	Account Name:		ramesh
	Account Domain:		OPTIPLEX-9020
	Logon ID:		0x92A6F

Audit Policy Change:
	Category:		Object Access
	Subcategory:		Filtering Platform Connection
	Subcategory GUID:	{0cce9226-69ae-11d9-bed3-505054503030}
	Changes:		Success removed, Failure removed

“Filtering Platform Connection” Audit enables automatically?

On some systems, the WFP auditing may get re-enabled automatically in a few minutes. If you run the above “auditpol /get ...” command-line, you may see that audit of “Success and Failure” entries have been switched on automatically (perhaps by some third-party security software installed on the computer.)

Malwarebytes “Brute Force Protection” setting

If you’re using Malwarebytes Premium and have enabled the Brute Force Protection option in the Security tab, turn the setting off.

If this setting is turned on, it enables WFP “Success and Failure” auditing automatically. Even if you disable auditing manually using auditpol.exe, Malwarebytes re-enables WFP auditing every 4-5 minutes.

Editor’s note: If you need the “Brute Force Protection” turned on and yet want to disable the WFP event logging, you may contact Malwarebytes support to see if a workaround is available.

Once done, re-run the following command from the admin Command Prompt:

auditpol /set /subcategory:"{0CCE9226-69AE-11D9-BED3-505054503030}" /success:disable /failure:disable

This disables the excessive logging of the Windows Filtering Platform (“Filtering Connection Platform”) “Success” and “Failure” events (Event ID 5156, 5157, and 5158).

Alternatively, for diagnostic purposes, you can opt to log only the “Failure” entries using the auditpol.exe command. The “Failure” entries would be significantly less in number when compared to “Success” entries.

As of this blog post, Malwarebyte’s current version is 4.5.11.202 — Update package version is 1.0.57424 — Component package version is 1.0.1716.

I noticed event ID 5156 is filling up my event logs. It logs one or two of these events literally every 2-3 seconds. Now my security logs are useless. I run SEP 11 which takes control of the windows firewall as well uses its own fire wall. I googled and
found that anti-virus software can be responsible for this behavior (like macaffee) and saw how I could disable logging of this event with auditpol.

My question is how can I be sure that this is my anti-virus software doing this? I can’t see anywhere in the log itself something that would link this to my antivirus product. The source address listed is always the broadcast address of my subnet and the
destination is any computer I make ANY network connection to (file servers, DCs, etc).

Here is what I am seeing:

The Windows Filtering Platform has permitted a connection.

Application Information:
	Process ID:		4
	Application Name:	System

Network Information:
	Direction:		Inbound
	Source Address:		mybroadcast.address.for.subnet
	Source Port:		137
	Destination Address:	IP.of.destination.PC
	Destination Port:		137
	Protocol:		17

Filter Information:
	Filter Run-Time ID:	0
	Layer Name:		Receive/Accept
	Layer Run-Time ID:	44

I haven’t really found to much info on event ID 5156, or at least info I can make
that much sense of. Would I ever really need this event to be logged? And why would my anti-virus software cause so many of these events?

Если у вас в журнале безопасности регистрируется довольно много сообщений с Event ID 5156, которые сообщают что

The Windows Filtering Platform has allowed a connection

и вы хотите их отключить, сделайте следующее:

• Запустите gpedit.msc
• Перейдите в ветку «Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options».
• Убедитесь что у вас, в Windows 2008, включена опция:  «Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings».

После этого нужно воспользоваться командой «auditpol». Введите команду:

auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

Если же вам хочется еще отключить и такие сообщения:

The Windows Filtering Platform blocked a packet

То выполняем команду:

auditpol /set /subcategory:"Filtering Platform Packet Drop" /failure:disable

Хотя, если честно, после жалоб «безопасника» на сообщения не несущие полезную информацию сообщения я отключаю вот так :

auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable

auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable

Чтоб посмотреть синтаксис этой команды введите в командной строке:

auditpol /?

Чтоб получить список всех категорий и под категорий введите:

auditpol /list /subcategory:*

Чтоб отобразить текущую политику аудита для всех категорий и подкатегорий введите:

auditpol /get /category:*

Начиная с Windows Server 2008 R2 (серверные ОС) и Windows 7 (не серверные ОС) в политиках по адресу  «Computer Configuration/Windows Settings/Security Settings/Advanced Audit Policy Configuration» появились более тонкие настройки аудита из более чем 50-ти различных настроек политики — Advanced Security Audit Policy Settings.

Если при использовании команды auditpol выскакивает «ошибка 0x00000057 произошла: Параметр задан неверно.», то скорее всего вы используете не тот язык в названии категорий, если ОС на русском языке, то категории аудита нужно писать на русском языке.

Понравилось? =) Поделись с друзьями: