What is event ID 5152?
Event 5152 indicates that a packet (IP layer) is blocked. Event 5157 and Event 5152 are general Windows Firewall security audit, you should look into the event detail of the blocked connection attempt to decide whether that attempt should be allowed.
How do I view security logs?
Open Event Viewer. In the console tree, expand Windows Logs, and then click Security. The results pane lists individual security events. If you want to see more details about a specific event, in the results pane, click the event.
What is security event ID 5152 by the thousands?
The Security Auditing Log is filling with thousands of identical events every hour. The event id is 5152. Log Name: Security Source: Security Event ID 5152 by the thousands Windows Vista Business 32-bit SP1 build 6.0.6001. The Security Auditing Log is filling with thousands of identical events every hour. The event id is 5152.
What is the security auditing log ID 5152?
The Security Auditing Log is filling with thousands of identical events every hour. The event id is 5152. Log Name: Security Source: Security Event ID 5152 by the thousands Windows Vista Business 32-bit SP1 build 6.0.6001.
When to monitor for 5152 events where the destination address is?
If the computer or device should not have access to the Internet, or contains only applications that don’t connect to the Internet, monitor for 5152 events where Destination Address is an IP address from the Internet (not from private IP ranges).
What is the meaning of IDID 5152?
ID Message. 5152 The Windows Filtering Platform blocked a packet. Event 5152 indicates that a packet (IP layer) is blocked. Event 5157 and Event 5152 are general Windows Firewall security audit, you should look into the event detail of the blocked connection attempt to decide whether that attempt should be allowed.