Windows Security Log Event 5156 & 5158

Tschuky101 1 Reputation point
2021-12-28T21:59:57.577+00:00

Hello,

I am running into an issue where our security logs are filling up on each of our DC's. In my GPO's I have setup the Advanced Audit Policies to have the auditing for "Object Access -> Audit Filtering Platform Connection" and "Object Access -> Audit Filtering Platform Packet Drop" set to "No Auditing". With these set and after a gpupdate /force I run "auditpol /get /subcategory:"Filtering Platform Connection"" and the results show that "Filtering Platform Connection" setting is set to success, and I can see in RSOP that the policies have applied to the DC's.

I have also tried to to run the command "auditpol /set /subcategory:”Filtering Platform Connection” /success:disable /failure:disable" to disable the logs via auditpol. In my security events I see that the command was successful, but then a few seconds later I can see another log where the "SYSTEM" user is re-enabling the log. Everything that I have seen online about these events is telling me to run the commands and set the GPO policies that I have set without any change in the logs.

Any help would be greatly appreciated.

Thank you

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,184 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,912 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,730 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,381 Reputation points
    2021-12-29T16:23:52.747+00:00

    Hello @Tschuky101

    I would recommend to run a "GPRESULT /h policies.html" command to review the policies applied, since it is highly possible that there is a "winning GPO that is resetting the policy.

    Hope this helps with your query,

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments
  2. Tschuky101 1 Reputation point
    2021-12-29T18:47:08.07+00:00

    @Limitless Technology When looking through the results of "GPRESULT /h policies.html" I don't see any policy overriding the setting. The winning GPO is my audit policy where I have the "Filtering Platform Connection" set to "No Auditing". After looking at this I have checked the audit policy by running "auditpol /get /category:*" and I see that the "Filtering Platform Connection" is set to "Success"

    0 comments
  3. Tschuky101 1 Reputation point
    2021-12-30T19:31:25.52+00:00

    This issue was related to our Malwarebytes install. One any server or computer that had Brute Force Protection version lower than 1.2.0.106 was unable to disable these logs. After updating the version from the Malwarebytes Nebula console we are able to update the Audit Policies. You can check the version by holding control and right clicking on the tray icon -> about.

    0 comments