Web. ke; no. Event viewer 5152. 0 policies. Has anyone seen this issue in the past and what was done to resolve it, here is an example of the event observed 160146 <13>Sep 12 142330 11. xxx (DNS Server) Destination Port 53. Remote desktop is. 5157 NA Low The Windows Filtering Platform has blocked a connection. If you are only using Windows Firewall, you can disable it via the advFirewall snap-in (WF. The Windows Filtering Platform has blocked a packet. 5152 The Windows Filtering Platform blocked a packet. xxx (Network PC) Source Port 4279. A magnifying glass. Event viewer 5152. Dec 01, 2017 Event ID 5152 - Windows Filtering Platform Blocked a Packet Posted by ronaldmacdonald on Dec 1st, 2017 at 612 AM Windows Server I&39;m seeing 10&39;s of thousands of event ID 5152 occurring in multiple servers&39; security logs. Application Information Process ID 0 Application Name - Network Information Direction Inbound Source Address ExternalWanAddress. Click on Small icons on the drop-down list. local Description The Windows Filtering Platform blocked a packet. This is the only user getting locked out. Web. Web. The windows filtering platform has blocked a packet 5152. Sep 10, 2015 Auditpol set subcategory"Filtering Platform Packet Drop" success disable failure disable Auditpol set subcategory"Filtering Platform Connection" success disable failure disable More information for you. You can use "NetSh. Web. Type command secpol. Their purpose is to prevent outbound responses (such as TCP resets) to inbound packets sent for the purpose of port IP and port discovery. 5157 The Windows Filtering Platform has blocked a connection. Click on Network Adapter and follow the on-screen instructions. 18 Destination Port 58459. Web. 5157 NA Low The Windows Filtering Platform has blocked a connection. Application Information Process ID 484 Application Name &92;device&92;harddiskvolume1&92;wi ndows&92;syst em32&92;svcho st. Deluxe All Butter Mince Pies (6), 1. Application Information Process ID 0 Application Name - Network Information . I had an interesting event yesterday where users reported sluggishness on an . 5157 The Windows Filtering Platform has blocked a connection. class"algoSlugicon" data-priority"2">Web. com TaskCategoryFiltering Platform Packet Drop OpCodeInfo RecordNumber36423970 KeywordsAudit Failure MessageThe Windows Filtering Platform has blocked a packet. A magnifying glass. The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. Event Id. 1 ginx. It indicates, "Click to perform a search". Here&39;s an . exe WFP Show State" to show you the list of filters on the machine. After that you use the following command to stop the capture. local Description The Windows Filtering Platform blocked a packet. I am at a loss. If we want to disable the logging events about 5152, please try the following steps Open an elevated command prompt. Windows Auditing can be annoying. Click on Network and Internet. 255 Destination Port 2008 Protocol 17 Filter Information Filter Run-Time ID 4267779 Layer Name Transport. This is the only user getting locked out. Block Windows Spotlight Allows IT admins to turn off all Windows Spotlight Features - Window spotlight on lock screen, Windows Tips, Microsoft consumer features, and other related features. 5154 NA Low The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. Packet Modification httpcode. . The windows filtering platform has blocked a packet 5152 EVID 5152 -5159 Windows Firewall Events (Part 2) (Deutsch - Security) Event Details Log Fields and Parsing This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2. Web. Run DISM tool. 5154 NA Low The WindowsWindows. Application Information Process ID 4 Application Name System Network Information Direction Inbound Source Address 192. Operating System -> Microsoft Windows -> Built-in logs -> Windows 2008 or higher -> Security Log -> Object Access -> Filtering Platform Packet Drop ->EventID 5152 - The Windows Filtering Platform blocked a packet. 5153 (S) A more restrictive Windows Filtering Platform filter has blocked a packet. 252 Source Port 5355 Destination Address 29. The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. Firewall default block filters Debugging packet drops is a continuous issue to Windows customers. When a network packet is blocked by the Windows Filtering Platform, event 5152 is logged. Any of these events corresponds to a Windows Firewall connection or packet drop. The two events were looking for are Event ID 5157 Filtering Platform Connection Event ID 5152 Filtering Platform Packet Drop Any of these events corresponds to a Windows Firewall connection or packet drop. A more restrictive Windows Filtering Platform filter has blocked a packet. (Shut up already) Notes on MS Integration, Administration, and Management Resolve issue with multiple Event ID 5152 and 5157 appearing in the security event log and some forums say its a MS server 2008 bug that requires a hotfix, some say it&39;s packets coming from Dropbox or Bonjour of the origin computer. Application Information. Web. This event log contains the following information Process ID; Application Name; Direction; Source Address; Source Port; Destination Address; Destination Port; Protocol; Filter Run-Time ID; Layer Name. The Windows Filtering Platform has blocked a packet. Application Name - Network Information. Nov 29, 2018 EventCode5152 EventType0 TypeInformation ComputerNameXXX. Run DISM tool. This is related to your firewall which block some traffic. 114 Source Port 54799 Destination Address 255. 1See more. Has anyone seen this issue in the past and what was done to resolve it, here is an example of the event observed 160146 <13>Sep 12 142330 11. Event Details User Activity -> Network and Firewall Tracking -> Windows Filtering Platform -> Windows 2008 ->EventID 5152 - The Windows Filtering Platform blocked a packet. A magnifying glass. The Windows Filtering Platform has blocked a packet. 5158 NA Low The Windows Filtering Platform has permitted a bind to a local. Run DISM tool. 255 Destination Port 67 Protocol 17 Filter Information Filter Run-Time ID 681273 Layer Name Transport. 5154 NA Low The WindowsWindows. This article tells . 71 Destination Port 445 Protocol 6 Filter Information Filter Run-Time ID 306834 Layer Name Receive. Windows firewall is enabled. 255 Destination Port 1947 Protocol 17 Filter Information Filter Run-Time ID 72655 Layer Name Transport. You could also use Netsh. To troubleshoot the issue, we suggest that you run the Network troubleshooter by following the steps below On the Start menu, click on Control Panel. EventCode5152 EventType0 TypeInformation ComputerNameXXX. exe WFP capture stop. Nov 21, 2022, 252 PM UTC vr th qu wc rj. In the past, customers had limited information about packet drops. It indicates, "Click to perform a search". Web. Web. Log In My Account wz. The Audit Failure is event is ID 5152 The Windows Filtering Platform has blocked a packet. The windows filtering platform has blocked a connection 5157. Search this website. This ONLY happens over BLAST UDP, not TCP, or PCoIP. In our security logs we are getting thousands of 5152 audit failures. This event log contains the following information Process ID; Application Name; Direction; Source Address; Source Port; Destination Address; Destination Port; Protocol; Filter Run-Time ID; Layer Name. Application Information. Dec 02, 2016 But, how does this article that you mention have anything to do with fixing the underlying issue that the Base Filtering EngineWindows Filtering Platform is actively blocking port 53 on those servers, even though the Windows Advanced Firewall is set to OFF. In our security logs we are getting thousands of 5152 audit failures. 5158 NA Low The Windows Filtering Platform has permitted a bind to a local. Click on Network and Internet. Event ID 5152 Filtering Platform Packet Drop. 104 Source Port 35533 Destination Address 192. Remote desktop is. The two events were looking for are Event ID 5157 Filtering Platform Connection Event ID 5152 Filtering Platform Packet Drop Any of these events corresponds to a Windows Firewall connection or packet drop. This is the only user getting locked out. 5156 NA Low The Windows Filtering Platform has allowed a connection. The Windows Filtering Platform has blocked a packet. Web. Application Information Process ID 0 Application Name - Network Information Direction Inbound Source Address 10. The two events were looking for are Event ID 5157 Filtering Platform Connection Event ID 5152 Filtering Platform Packet Drop Any of these events corresponds to a Windows Firewall connection or packet drop. Suspicious incoming connection for specific application or service listening on a port ,Windows Filtering Platform has blocked 5153 Attacker tried to access a network,user, a group, a computer, an application, a printer, or a shared folder for which Windows Filtering Platform has dropped a packet and blocked 5152. Feb 06, 2014 The Windows Filtering Platform has blocked a packet. 5152 The Windows Filtering Platform blocked a packet. exe therefore no DNS Forwarding to the Internet from the DNS Server. Web. It indicates, "Click to perform a search". 255 Destination Port 67 Protocol 17 Filter Information Filter Run-Time ID 681273 Layer Name Transport. 5157 The Windows Filtering Platform has blocked a connection. The Security Auditing Log is filling with thousands of identical events every hour. Nov 08, 2011 On our Windows Server 2008 R2 I have in the eventlog many packet drops with event 5152, Category "Filtering Platform Packet Drop", but I have everything allowed in the firewall. Remote desktop is. A magnifying glass. If we want to disable the logging events about 5152, please try the following steps Open an elevated command prompt Type and run the command Auditpol get category Get the output Filtering Platform Packet Drop failure Enabled and Filtering Platform Connection failure Enabled. Application Information Process ID 0 Application Name - Network Information Direction Inbound Source Address 192. Linked Event. Event viewer 5152. Examples of 5157 The Windows Filtering Platform has blocked a connection. 71 Source Port 62552 Destination Address 192. Web. The windows filtering platform has blocked a connection 5157. Nov 08, 2011 If you are only using Windows Firewall, you can disable it via the advFirewall snap-in (WF. Any of these events corresponds to a Windows Firewall connection or packet drop. We and our partners store andor access information on a device, such as cookies and process personal data, such as unique identifiers and standard information sent by a device for personalised ads and content, ad and content measurement, and audience insights, as well as to develop and improve products. Web. Web. Application Information Process ID 0 Application Name - Network Information Direction Inbound Source Address 192. Log Name Security Source Microsoft-Windows-Security-Auditing Date 3202020 11408 PM Event ID 5152 Task Category Filtering Platform Packet Drop Level Information Keywords Audit Failure User NA Computer <redacted> Description The Windows Filtering Platform has blocked a packet. The Windows Filtering Platform has blocked a packet. Application Information Process ID 4 Application Name System Network Information Direction Inbound Source Address 192. To troubleshoot the issue, we suggest that you run the Network troubleshooter by following the steps below On the Start menu, click on Control Panel. The Windows Firewall on this server has the default Active Directory. The Windows Filtering Platform has blocked a packet. 255 Destination Port 1947 Protocol 17 Filter Information Filter Run-Time ID 72655 Layer Name Transport. For 5152 (F) The Windows Filtering Platform blocked a packet. If not, head to the fix listed next. It indicates, "Click to perform a search". You can use "NetSh. Event-o-Pedia EventID 5152 - The Windows Filtering Platform blocked a packet. Application Information. Web. Application Name - Network Information. 5156 NA Low The Windows Filtering Platform has allowed a connection. Dec 10, 2020 Event ID 5152 Task Category Filtering Platform Packet Drop Level Information Keywords Audit Failure User NA Computer computer. 255 Destination Port 1947 Protocol 17 Filter Information Filter Run-Time ID 72655 Layer Name Transport. Remote desktop is. Web. Click on Network Adapter and follow the on-screen instructions. Click on Small icons on the drop-down list. Aug 07, 2018 If we want to disable the logging events about 5152, please try the following steps Open an elevated command prompt Type and run the command Auditpol get category Get the output Filtering Platform Packet Drop failure Enabled and Filtering Platform Connection failure Enabled. A magnifying glass. Anybody find a solution - Sophos Endpoint Software - On-Premise Endpoint - Sophos Community. The Windows Filtering Platform has blocked a packet. Field level details. The windows filtering platform has blocked a connection 5157. If you want to disable the firewall, that should be done in the Firewall GPO settings. com TaskCategoryFiltering Platform Packet Drop OpCodeInfo RecordNumber36423970 KeywordsAudit Failure MessageThe Windows Filtering Platform has blocked a packet. Dec 02, 2016 Event 5152. 5158 NA Low The Windows Filtering Platform has permitted a bind to a local. A magnifying glass. The Windows Filtering Platform has blocked a packet. Web. " The meaning of the word &x27;connection&x27; in Event 5157 is not the same as the connection in OSI model transport layer. com Description The Windows Filtering Platform has blocked a packet. Press question mark to learn the rest of the keyboard shortcuts. 5154 NA Low The WindowsWindows. I have a user who keeps getting locked out I see in the event logs that it is coming from other computers. Search this website. This is the only user getting locked out. It indicates, "Click to perform a search". Web. Application Name - Network Information. Click on Troubleshooting. When a network packet is blocked by the Windows Filtering Platform, event 5152 is logged. 5154 NA Low The WindowsWindows. Analyze the entire log to . Firewall default block filters Debugging packet drops is a continuous issue to Windows customers. Feb 06, 2014 The Windows Filtering Platform has blocked a packet. Jan 09, 2022 After making the changes, restart the system and check if the Windows Filtering Platform has blocked a connection problem is eliminated in Windows 11. Mini-seminars on this event. Application Information Process ID 4 Application Name System Network Information Direction Inbound Source Address 192. A more restrictive Windows Filtering Platform filter has blocked a packet. Aug 07, 2018 If we want to disable the logging events about 5152, please try the following steps Open an elevated command prompt Type and run the command Auditpol get category Get the output FilteringPlatformPacketDrop failure Enabled and FilteringPlatformConnection failure Enabled. Jan 09, 2022 Press Windows R to launch the Run command. Event viewer 5152. I have a user who keeps getting locked out I see in the event logs that it is coming from other computers. Default Yes. Click Yes on the UAC (User Account Control) prompt. Security Event ID 5152 by the thousands. The Windows Filtering Platform has blocked a connection. A more restrictive Windows Filtering Platform filter has blocked a packet. Event ID 5152 and 5157 DNS. It indicates, "Click to perform a search". Press Windows S to launch the Search menu. The Windows Filtering Platform has blocked a packet. The Windows Filtering Platform has blocked a packet. Web. 5154 NA Low The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. Typically, when investigating packet drop events, a customer would use the field Filter Run-Time ID from Windows Filtering Platform (WFP) audits 5157 or 5152. KeywordsAudit Failure MessageThe Windows Filtering Platform has blocked a packet. Application Information Process ID 0 Application Name - Network Information Direction Inbound Source Address ExternalWanAddress. If you really want to get the bottom of this kind of problem you will have to perform a WFP (Windows Filtering Platform) capture. The Windows Filtering Platform has blocked a packet. This event log contains the following information Process ID Application Name Direction Source Address Source Port Destination Address Destination Port Protocol Filter Run-Time ID Layer Name. 102 Destination Port 56927 Protocol 17. The Windows Filtering Platform has blocked a packet. The 5152 events are misleading in this way because from the text they seem to indicate the INBOUND packet was dropped, when really, it was the OUTBOUND packet that was dropped. If we want to disable the logging events about 5152, please try the following steps Open an elevated command prompt. A magnifying glass. This event log contains the following information Process ID Application Name Direction Source Address Source Port Destination Address Destination Port Protocol Filter Run-Time ID Layer Name. Get the output "Filtering Platform Packet Drop" failure Enabled and "Filtering Platform Connection" failure Enabled. Click Yes on the UAC (User Account Control) prompt. Web. Event viewer 5152. Web. Web. I have a user who keeps getting locked out I see in the event logs that it is coming from other computers. "Event 5157 indicates that a connection (Transport layer) is blocked while Event 5152 indicates that a packet (IP layer) is blocked. Remote desktop is. 5154 NA Low The WindowsWindows. Perhaps Microsoft has most of the responsibility for this bug, but it is quite rare to see the 5152 problem on Windows systems without 3rd party endpoint protection and quite a bit more common to see it on systems that do have 3rd party protection. Looks like the blocked packets are originating from all the Windows workstations on the network. Perhaps Microsoft has most of the responsibility for this bug, but it is quite rare to see the 5152 problem on Windows systems without 3rd party endpoint protection and quite a bit more common to see it on systems that do have 3rd party protection. Inc Description The Windows Filtering Platform has blocked a packet. laurel coppock nude, twin wall polycarbonate panels for greenhouses
xxx (Network PC) Source Port 4279 Destination Address 192. . The windows filtering platform has blocked a packet 5152
Enter Windows Terminal in the text field at the top, right-click on the relevant search result. EventCode5152 EventType0 TypeInformation ComputerNameXXX. Not sure what Sophos 2nd level support did, but the problem magically disappeared the audit 5152 records have stopped, and the network traffic seems better as the workstations are preforming better again. exe therefore no DNS Forwarding to the Internet from the DNS Server. The Windows Filtering Platform blocked a packet. This is the only user getting locked out. This is not an exhaustive list of Windows Event Codes, nor is it a complete list for each use case. Windows event ID 5152 - The Windows Filtering Platform blocked a packet Event ID 5152 Category Object Access Subcategory Filtering Platform Packet Drop Supported on Windows Vista, Windows Server 2008 The Windows Filtering Platform blocked a packet. This event log contains the following information Process ID Application Name Direction Source Address Source Port Destination Address Destination Port Protocol Filter Run-Time ID Layer Name. 00 0. Press Windows R to launch the Run command. This event log contains the following information Process ID Application Name Direction Source Address Source Port Destination Address Destination Port Protocol Filter Run-Time ID Layer Name. The Windows Filtering Platform has blocked a packet. Auditpol set subcategory"Filtering Platform Packet Drop" success disable failure disable Auditpol set subcategory"Filtering Platform Connection" success disable failure disable More information for you. 255 Destination Port 1211 Protocol 17 Filter Information Filter Run-Time ID 456686 Layer Name Transport. Web. Its important to keep an eye on these events to make sure any unexpected or unapproved actions are captured. Windows Auditing can be annoying. A more restrictive Windows Filtering Platform filter has blocked a packet. The Windows Filtering Platform has blocked a packet. The Security Auditing Log is filling with thousands of identical events every hour. Event ID 5157 "Filtering Platform Connection" Event ID 5152 "Filtering Platform Packet Drop" Any of these events corresponds to a Windows Firewall connection or packet drop. Application Information Process ID 0 Application Name - Network Information Direction Inbound Source Address 192. exe therefore no DNS Forwarding to the Internet from the DNS Server. When a network packet is blocked by the Windows Filtering Platform, event 5152 is logged. Windows Filtering Platform is a set of API and system services that provide a platform for creating network filtering applications. Firewall default block filters Debugging packet drops is a continuous issue to Windows customers. 252 Source Port 5355 Destination Address 10. " The meaning of the word &39;connection&39; in Event 5157 is not the same as the connection in OSI model transport layer. Mini-seminars on this event. 71 Destination Port 445 Protocol 6 Filter Information Filter Run-Time ID 306834 Layer Name Receive. Click Yes on the UAC (User Account Control) prompt. I&x27;ve looked at httpsdocs. 5152 The Windows Filtering Platform blocked a packet On this page Description of this event ; Field level details; Examples; Discuss this event; Mini-seminars on this event; This event logs all the particulars about a blocked packet including the filter that caused the block. The Security Auditing Log is filling with thousands of identical events every hour. We are a PCoIP shop beginning to test BLAST after our recent upgrade to UAGs and Horizon 7. Dec 02, 2016 Event 5152. Event-o-Pedia EventID 5152 - The Windows Filtering Platform blocked a packet. Type command secpol. Aug 07, 2018 If we want to disable the logging events about 5152, please try the following steps Open an elevated command prompt. Web. Also, this can be caused by disabling the firewall service, which you should not do. The Windows Filtering Platform has blocked a packet. local Description The Windows Filtering Platform blocked a packet. Event Description This event generates when Windows Filtering Platform has blocked a network packet. You can use "NetSh. 5155 NA Low The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. I had an interesting event yesterday where users reported sluggishness on an . The Security Auditing Log is filling with thousands of identical events every hour. I have a user who keeps getting locked out I see in the event logs that it is coming from other computers. 152 Source Port 68 Destination Address 255. Perhaps Microsoft has most of the responsibility for this bug, but it is quite rare to see the 5152 problem on Windows systems without 3rd party endpoint protection and quite a bit more common to see it on systems that do have 3rd party protection. 255 Destination Port 1211 Protocol 17 Filter Information Filter Run-Time ID 456686 Layer Name Transport. 114 Source Port 54799 Destination Address 255. Culprit found Filter Run-Time ID 68338 Make a note of the Filter Run-Time ID. Application Information Process ID 0 Application Name - Network Information Direction Inbound Source Address 10. Packet Modification httpcode. Web. 71 Destination Port 445 Protocol 6 Filter Information Filter Run-Time ID 306834 Layer Name Receive. We setup 4 new DC&39;s in our AD domain after we updated our schema to 2008 R2. Web. xxx (DNS Server) Destination Port 53. The windows filtering platform has blocked a connection 5157. corp Description The Windows Filtering Platform blocked a packet. The windows filtering platform has blocked a connection 5157. This is the only user getting locked out. . The windows filtering platform has blocked a connection 5157. Jan 09, 2022 After making the changes, restart the system and check if the Windows Filtering Platform has blocked a connection problem is eliminated in Windows 11. Application Information Process ID 0 Application Name - Network Information Direction Inbound Source Address 10. The Security Auditing Log is filling with thousands of identical events every hour. Anybody find a solution - Sophos Endpoint Software - On-Premise Endpoint - Sophos Community. 5154 NA Low The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. The Windows Filtering Platform has blocked a packet. I&39;ve opened a case with VMware and they are so far stumped and suggested we open a case with Microsoft. Event viewer 5152. Web. comen-uswindowssecuritythreat-protectionauditingevent-5152textSecurity Monitoring Recommendations hIDSERP,5595. exe Network Information Direction Inbound Source Address 127. Application Information Process ID 0 Application Name - Network Information Direction Inbound Source Address 10. This event is logged for every received network packet. The windows filtering platform has blocked a connection 5157. For 5152 (F) The Windows Filtering Platform blocked a packet. exe WFP Show State" to show you the list of filters on the machine. 255 Destination Port 67 Protocol 17 Filter Information Filter Run-Time ID 681273 Layer Name Transport. 71 Source Port 62552 Destination Address 192. This event log contains the following information Process ID Application Name Direction Source Address Source Port Destination Address Destination Port Protocol Filter Run-Time ID Layer Name. 1See more. The Windows Filtering Platform has blocked a packet. Starfinder is a stand-alone roleplaying game evolved from Paizo&39;s Pathfinder rules that is set thousands of years in Pathfinder&39;srules that is set thousands of years in. And you need to use this in a startup script GPO for your dc&x27;s or it will be reset when you restart. Browse Top Apache Developers Hire an Apache Developer. This event logs all the particulars about a blocked packet including the filter that caused the block. 104 Source Port 35533 Destination Address 192. exe WFP capture start , repro the event, and Netsh. 100&39;s of logged events The Windows filtering Platform has blocked a packet (5152) it appears that Sophos end point security is causing out log files to fill up with this error and may be generating unnecessary network traffic. The Security Auditing Log is filling with thousands of identical events every hour. " The meaning of the word &39;connection&39; in Event 5157 is not the same as the connection in OSI model transport layer. I have a user who keeps getting locked out I see in the event logs that it is coming from other computers. Press Windows S to launch the Search menu. Web. The Windows Filtering Platform has blocked a packet. Mar 28, 2022 5157 The Windows Filtering Platform has blocked a connection. This is the only user getting locked out. Click Yes on the UAC (User Account Control) prompt. Source Address 192. Event ID 5152 ; Category Object Access ; Subcategory Filtering Platform Packet Drop ; Supported on Windows Vista, Windows Server 2008. Their purpose is to prevent outbound responses (such as TCP resets) to inbound packets sent for the purpose of port IP and port discovery. Application Information Process ID 4 Application Name System Network Information Direction Inbound Source Address 192. Jan 09, 2022 After making the changes, restart the system and check if the Windows Filtering Platform has blocked a connection problem is eliminated in Windows 11. He is also well-versed in ethical hacking and penetration testing techniques and has been. " The meaning of the word &39;connection&39; in Event 5157 is not the same as the connection in OSI model transport layer. 5154 NA Low The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. Log Name Security Source Microsoft-Windows-Security-Auditing Date 10272009 95334 PM Event ID 5152 Task Category Filtering Platform Packet Drop Level Information Keywords Audit Failure User NA Computer dcc1. The Windows Filtering Platform has blocked a packet. Enter wt in the text field, press and hold the Ctrl Shift keys, and then either click on OK or hit Enter to launch an elevated Windows Terminal. This event log contains the following information Process ID Application Name Direction Source Address Source Port Destination Address. Nov 08, 2011 On our Windows Server 2008 R2 I have in the eventlog many packet drops with event 5152, Category "Filtering Platform Packet Drop", but I have everything allowed in the firewall. The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. A magnifying glass. . essex moodle