Event ID: 5447

A Windows Filtering Platform filter has been changed.

A Windows Filtering Platform filter has been changed.

Subject:
    Security ID:        %2
    Account Name:       %3

Process Information:
    Process ID: %1

Provider Information:
    ID:     %4
    Name:       %5

Change Information:
    Change Type:    %6

Filter Information:
    ID:     %7
    Name:       %8
    Type:       %9
    Run-Time ID:    %10

Layer Information:
    ID:     %11
    Name:       %12
    Run-Time ID:    %13

Callout Information:
    ID:     %17
    Name:       %18

Additional Information:
    Weight: %14 
    Conditions: %15
    Filter Action:  %16
Microsoft Documentation

Event ID - 5447





Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Policy Change Events"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List