Event ID 5442
The following provider was present when the Windows Filtering Platform Base Filtering Engine started.The following provider was present when the Windows Filtering Platform Base Filtering Engine started. Provider ID: %1 Provider Name: %2 Provider Type: %3
This event is logged for each Windows Filtering Platform provider present when the Base Filtering Engine starts as part of Windows boot up. The Windows Filtering Platform is a foundation component of Windows that provides an API and base filtering engine upon which other network filtering applications are built, including several Windows networking components and potentially third-party applications.
Enable only when you need a full inventory of WFP providers loaded at boot — useful for forensic baseline comparison, detecting rogue or malicious third-party providers injected by malware, or validating that only expected software has registered as a WFP provider.
A standard Windows system has only 3–6 built-in providers. Even with third-party security software, total count per reboot is typically fewer than 15 events. Always bounded per boot — never a continuous stream.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Filtering Platform Policy Change"
LEFT/RIGHT arrow keys for navigation
Back to List