Problem with too much Event 5447

Discussion in 'Server Security' started by Marc Allard, Mar 31, 2010.

  1. Marc Allard

    Marc Allard Guest

    Hello,

    I have a very strange problem with Windows server 2008 R2
    Every 2-3 minutes, I receive 40-50 times the event ID 5447
    A windows filtering platform has been changed

    SecurityID = Local service
    Account name NT AUTHORITY\LOCAL SERVICE


    The name is Terminal Services
    I have no idea about what to do, but I have less than 12 hours for the log
    to fill the 20 MB
    Can someone please help me to see what iswrong?

    Thank you
    Marc
     
    Marc Allard, Mar 31, 2010
    #1
    1. Advertisements

  2. Marc Allard

    Marc Allard Guest

    Hello,

    After more investigation, it seems that it is the Windows firewall that does
    all the events for all the process runing on the computer (hyper-v, rdp,
    ....)
    there is an event enabling the ALE listen v4 layer, ALE listen v4 layer
    After that, the same event with the delete of the ALE V4 and V6 Layer.


    Thank you
    Marc
     
    Marc Allard, Apr 1, 2010
    #2
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.