Event ID 5448
A Windows Filtering Platform provider has been changed.A Windows Filtering Platform provider has been changed.
Subject:
Security ID: %2
Account Name: %3
Process Information:
Process ID: %1
Change Information:
Change Type: %4
Provider Information:
ID: %5
Name: %6
Type: %7This event is generated by the Windows Filtering Platform (WFP). It specifically tracks changes made to a WFP Provider, which is the software component (such as an antivirus, firewall, or VPN client) that manages network filters and callouts.
Whenever a security application registers its presence or updates its identity within the Windows network stack, this event is triggered.
Auditing:
Always
In a standard environment, these events are relatively infrequent and usually occur during software installations or system updates. Monitoring them is useful for ensuring security software health, malware detection, troubleshooting and audit compliance.
Volume:
Low
Medium
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Filtering Platform Policy Change"
LEFT/RIGHT arrow keys for navigation
Back to List