Windows Filtering Platform blocked a connection.
Source of event
Microsoft-Windows-Security-Auditing — Security category.
Possible causes
- RuleGolden Windows
- Application not permitted
- Incoming or outgoing filtered trafic
Verifications to be carried out
- Identify Application
- Read Source/Destination Address and Port
- Check ActiveGart Profile
Commands
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5157} -MaxEvents 50Key takeaways
An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.