Event ID:
5447
Category:
Policy Change
Subcategory:
Other Policy Change Events
Supported on:
Windows Vista, Windows Server 2008
A Windows Filtering Platform filter has been changed.
Subject:
Security ID: %2
Account Name: %3
Process Information:
Process ID: %1
Provider Information:
ID: %4
Name: %5
Change Information:
Change Type: %6
Filter Information:
ID: %7
Name: %8
Type: %9
Run-Time ID: %10
Layer Information:
ID: %11
Name: %12
Run-Time ID: %13
Callout Information:
ID: %17
Name: %18
Additional Information:
Weight: %14
Conditions: %15
Filter Action: %16