Event ID 5441
The following filter was present when the Windows Filtering Platform Base Filtering Engine started.The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
Provider Information:
ID: %1
Name: %2
Filter Information:
ID: %3
Name: %4
Type: %5
Run-Time ID: %6
Layer Information:
ID: %7
Name: %8
Run-Time ID: %9
Weight: %10
Additional Information:
Conditions: %11
Filter Action: %12
Callout ID: %13
Callout Name: %14This is a Success Audit event that is generated exclusively during the system boot sequence. It provides a point-in-time inventory of every persistent filter currently registered within the Base Filtering Engine (BFE).
Auditing:
Rarely
This event is logged for each filter of each WFP provider at startup. Enable only if you need a full WFP filter baseline at boot for forensic comparison or to detect unauthorized persistent filters added by malware or rogue drivers.
Volume:
Low
Medium
A single WFP provider can register dozens of filters. On servers running AV, EDR, or VPN software with complex WFP rulesets the count can reach several hundred per boot.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Filtering Platform Policy Change"
LEFT/RIGHT arrow keys for navigation
Back to List