Windows Security Log Event ID 5446
| Operating Systems |
Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
|
Category
• Subcategory | Policy Change
• Filtering Platform Policy Change |
|
Type
|
Success
|
Corresponding events
in Windows
2003
and before |
|
5446: A Windows Filtering Platform callout has been changed
On this page
A WFP callout is aet of functions in a driver used for specialized filtering. Callouts can block, permit, modify and secure network traffic. For more information on WFP and providers see 5442.
This event is logged whenever a callout is added or deleted.
Free Security Log Resources by Randy
Subject:
The user and logon session that performed the action.
- Security ID: The SID of the account.
- Account Name: The account logon name with domain.
Process Information:
- Process ID is the process ID specified when the executable started as logged in 4688.
Provider Information:
- Provider ID: Globally unique identifier of the provider
- Provider Name: name of the provider
Change Information:
- Change Type: "Add" or "Delete"
Callout Information:
- ID: GUID of the callout
- Name: call out name
- Type: "Not persistent" or "Persistent"
- Run-Time ID:
Layer Information:
- ID: GUID of the layer
- Name: Layer name
- Run-Time ID:
Supercharger Enterprise
Load Balancing for Windows Event Collection
A Windows Filtering Platform callout has been changed.
Subject:
Security ID: LOCAL SERVICE
Account Name: NT AUTHORITY\LOCAL SERVICE
Process Information:
Process ID: 1364
Provider Information:
ID: {9250a3db-5929-4952-b834-e88709b0a35e}
Name: WFKMP
Change Information:
Change Type: Add
Callout Information:
ID: {c3dbed20-0bb6-4bf3-828d-96732e1e051a}
Name: Windows Firewall: callout
Type: Not persistent
Run-Time ID: 279
Layer Information:
ID: {fa45fe2f-3cba-4427-87fc-57b9a4b10d00}
Name: Datagram Data v6 Layer
Run-Time ID: 26
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection