Categories: Windows Server

SOLVED: How to Disable Event 5156: Windows Filtering Platform has permitted a connection

If you are like me, your 125MB Windows Server 2008 R2 logs are jammed with “Event 5156: Windows Filtering Platform has permitted a connection”:

Event 5156: Windows Filtering Platform has permitted a connection

I could not figure out how to disable this because in LOCAL SECURITY POLICY it was greyed out, which I know means it is controlled by a Group Policy:

I was working on the DEFAULT DOMAIN POLICY which was not correcting the problem. The solution was to change the DEFAULT DOMAIN CONTROLLER POLICY > POLICIES > WINDOWS SETTINGS > SECURITY SETTINGS > AUDIT POLICY > AUDIT OBJECT ACCESS settings:

event-5156-The-Windows-Filtering-Platform-has-permitted-a-connection-domain-controller-gp

 

View Comments

  • If you would like to get rid of this Filtering Platform Connection event 5156 then you need to run the following commands in an elevated command prompt (Run As Administrator):

    Auditpol /set /subcategory:"Filtering Platform Connection" /Success:disable

    Then update gpo by this command

    gpupdate /force

Leave a Comment
Published by
Ian Matthews
Tags: AUDIT OBJECT ACCESSDEFAULT DOMAIN CONTROLLER POLICYEvent 5156Windows Filtering Platform has permitted a connection
11 years ago

This website uses cookies.