Share via


Audit Filtering Platform Connection

Applies To: Windows 7, Windows Server 2008 R2

This security policy setting determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform, such as when:

  • The Windows Firewall service blocks an application from accepting incoming connections on the network.

  • The Windows Filtering Platform allows or blocks a connection.

  • The Windows Filtering Platform permits or blocks a bind to a local port.

  • The Windows Filtering Platform permits or blocks the listening of an application or service on a port for incoming connections.

Event volume: High

Default: Not configured

If this policy setting is configured, the following events are generated. The events appear on computers running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista, unless otherwise noted.

Event ID Event message

5031

The Windows Firewall Service blocked an application from accepting incoming connections on the network.

5140

A network share object was accessed.

Note
This event is logged only on computers running Windows Server 2008 R2 or Windows 7.

5150

The Windows Filtering Platform blocked a packet.

5151

A more restrictive Windows Filtering Platform filter has blocked a packet.

5154

The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.

5155

The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.

5156

The Windows Filtering Platform has allowed a connection.

5157

The Windows Filtering Platform has blocked a connection.

5158

The Windows Filtering Platform has permitted a bind to a local port.

5159

The Windows Filtering Platform has blocked a bind to a local port.