Event ID: 5447A Windows Filtering Platform filter has been changed.
A Windows Filtering Platform filter has been changed. Subject: Security ID: %2 Account Name: %3 Process Information: Process ID: %1 Provider Information: ID: %4 Name: %5 Change Information: Change Type: %6 Filter Information: ID: %7 Name: %8 Type: %9 Run-Time ID: %10 Layer Information: ID: %11 Name: %12 Run-Time ID: %13 Callout Information: ID: %17 Name: %18 Additional Information: Weight: %14 Conditions: %15 Filter Action: %16
This event is mainly used for troubleshooting purposes and has little to no security relevance.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Other Policy Change Events"
LEFT/RIGHT arrow keys for navigationBack to List