Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was seeing a lot of entries in the eventlog:

The Windows Filtering Platform has permitted a connection.
Application Information:
    Process ID:                4
    Application Name:          System
Network Information:
    Direction:                  Inbound
    Source Address:   
    Source Port:                80
    Destination Address:
    Destination Port:           31773
    Protocol:                   6
Filter Information:
    Filter Run-Time ID:         67903
    Layer Name:                 Receive/Accept
    Layer Run-Time ID:          44

We have a loadbalancer which checks every second to see if the application is still running (a health check). The logs contain large amounts of this kind of entries, which makes the Event Viewer slow and it's difficult to find the more interesting logs.

How do I make sure these messages don't end up in the event logs?

share|improve this question
@joeqwerty I rephrased it into a question, maybe you could remove the downvote and your comment (so it will be clear), thanks for the nudge to follow the appropiate guidlines! – Jaap Oct 1 '12 at 14:46
Fair enough. done. – joeqwerty Oct 1 '12 at 15:27
up vote 1 down vote accepted

You can turn off this type of logs with the following command line statement:

auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

Found it here:

share|improve this answer

Yes you can get rid of many ways ..


Solution 1: If you would like to get rid of this Filtering Platform Connection event 5156 then you need to run the following commands in an elevated command prompt (Run As Administrator):

Auditpol /set /subcategory:"Filtering Platform Connection" /Success:disable

Then update gpo by this command

gpupdate /force

Solution 2 :

You can also disable Filtering Platform Connection in Advanced Audit Policy Configuration of Local Security Policy.

1. Press the key Windows + R
2. Type command secpol.msc, click OK
3. Then go to the node Advanced Audit Policy Configuration->Object Access.
4. Check the audit setting **Audit Filtering Platform Connection** If it is configured as Success, you can   revert it Not Configured and Apply the setting.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.