Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just installed Windows Server 2008R2 SP1 to see if it would fix this problem, but it didn't. Until an administrator logs onto the domain controller, there are many events that WFP blocked a connection from Server60 to Server60 or Server60 to Server70. Both server60 and server70 are the domain controllers. One the admin logs on, the WFP events stop.

The firewall is off by default GPO. Yes, i know that the WFP kicks in during the boot up sequence until the firewall takes over or in my case does not take over (since Vista), but i clearly should not have to autologon to a domain controller and call autolock or something.

Example event
LEVEL = Information Source = Microsoft Windows Security Auditing EventID = 5152 "Filtering Platform Packet Drop" and its evil twin id = 5157 "Filtering Platform Connection"

"The Windows Filtering platform has blocked a connection."  
Direction %%14593 
SourcePort 49677 
DestPort 389 
Protocol 6 
FilterRTID 65667 
LayerName %%14611 
LayerRTID 48 
RemoteUserID S-1-0-0 
RemoteMachineID S-1-0-0 

windows-server-2008-r2 WFP BFE WindowsFilteringPlatform BaseFilteringEngine

share|improve this question
Just to be sure, the GPO is a Computer Policy applied to a computer object - right? Otherwise by the sounds of it, requiring a Domain Administrator to logon before it kicks over could be because the GPO is only applied to the user object, hence the domain admin logging on and it all suddenly working... – Ashley Steel Jul 26 '11 at 0:22

You disable this using the following commands:

auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure: disable
auditpol /set /subcategory:"Filtering Platform Connection" /success: disable /failure: disable
auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable

Source: The Windows Filtering Platform has blocked a bind to a local port

share|improve this answer
That article is not for 2008 Release 2. It does suggest these issues would be fixed in a newer release of tcpip.sys. Granted, these events would not show up in the event log by disabling whether they are audited, but it does not fix the underlying issue. Just like YY commented in the article, the server should behave the same whether or not an admin logs on first. – rjt Mar 12 '11 at 3:16
I this case, as the lastest comment in het blog, I would suggest you create a support case at Microsoft for this issue. This is one the issues which is very hard to troubleshoot using a forum. – Guido van Brakel Mar 12 '11 at 15:49
@rjt - Actually shadowman is right. This also applies to Windows 2008 R2. And you need to use this in a startup script GPO for your dc's or it will be reset when you restart. Also, this can be caused by disabling the firewall service, which you should not do. If you want to disable the firewall, that should be done in the Firewall GPO settings. – Greg Askew Dec 10 '11 at 0:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.