Event ID 5157 — Connecting blocked by Windows Filtering Platform

Windows Filtering Platform blocked a connection.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• RuleGolden Windows
• Application not permitted
• Incoming or outgoing filtered trafic

Verifications to be carried out

1. Identify Application
2. Read Source/Destination Address and Port
3. Check ActiveGart Profile

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5157} -MaxEvents 50

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.