Windows 10: Audit Failure Windows Filtering Platform has blocked connection - Application:...

I keep getting this Audit Failure alert in Windows Security Log. How can I fix this?Log Name: SecuritySource: Microsoft-Windows-Security-AuditingDate: 2023-12-06 9:35:41 AMEvent ID: 5157Task Category: Filtering Platform ConnectionLevel: InformationKeywords: Audit FailureUser: &n

:)

 

Unexpected Audit Failure in Event Viewer

Even with years of experience with Windows operating systems I am in the unenviable position of trying to diagnose an Audit Failure in the Event Viewer for Windows 10 on my Toshiba laptop that just reared its ugly head recently.

It is perhaps noteworthy that I am not seeing the same Audit Failure on my Dell desktop. Moreover "Filtering Platform Connection" never appears. This despite the fact both computers have the same (non-hardware specific) software installed and both are
connected problem free to my home network and printer.

Anyone know what causes (or triggers) the Security Task Category called Filtering Platform Connection?

Every occurrence results in an Audit Failure as shown below.

While some may want to focus on what is causing the Filtering Platform Connection failure to occur --
I am focusing instead on trying to figure out why I am getting the "Filtering Platform Connection" at all -- since it never appears on my desktop. But I've been wrong before.

Perhaps the task ""Filtering Platform Connection" only appears in the Event Viewer if there is an Audit Failure.

 

Unexpected Audit Failure in Event Viewer

I did make some progress in that I can disable the Audit Failure from being logged with the Event Viewer.

Go to Command Promp (Admin) and enter:

auditpol /set /subcategory:”Filtering Platform Connection” /success:disable /failure:disable

Caveat: Someone posted that the Audit Failure will likely return the next day.

Plus this is tantamount to replacing a fuse without fixing the underlying problem which is causing the fuse to blow.

Still hoping an Event Viewer / "Filtering Platform Connection" guru will chime in.

 

what started 30,000 "filtering platform connection" messages?

I occasionally look at my windows event log and today I spotted 30000+ messages that occurred within 2 hours after a reboot. I have never seen this before. What caused it? None of my other systems show anything like this.

I see a lot of acronis true image monitor maybe %75

also Nero, Edge, svchost etc almost every app I have used shows up

A week ago, I installed Malwarebytes. Could this cause the problem?

Most of the messages state "The Windows Filtering Platform has permitted a bind to a local port."

or simply mention connection.

Looking in the Application log I see a lot of warning from "Perflib: "Performance for this service will not be available? about 10,000 times

The performance of this seems doe sseem to have slowed down, possibly all the messages causing the slowdown?

WmiApRpl" in DLL "C:\WINDOWS\system32\wbem\wmiaprpl.dll" failed with error code is the typical Perflib reported problem

could this cause the filtering problem?

How do I stop all those filtering and how to fix the PerfLib warning

thanks for looking

[edit] Found the solution to what started this: Malwarebytes activated auditing as explained here:

Disable “Filtering Platform Connection” (Event ID 5156, 5158) Security Logging

Going to gid of AcronisTrueImage 2018 if I cannot stop what its monitor is doing. I do not need any more web protection for 3rd and 4th parties

Not