Event ID 5156: the Windows Filtering Platform has permitted a connection
Event 5156 is the counterpart of 5157: every connection the Windows Firewall allowed, with program, direction, addresses and ports. That is extremely detailed – and extremely noisy: on a busy Server it can be thousands of events per minute. Switch it on only briefly, to answer a specific question.
- What it is: an allowed connection (inbound or outbound), with program and addresses.
- Switch on: Filtering Platform Connection – Success. Off again afterwards.
- Good for: "which program talks to this address?", "who connects to my SQL Server?", checking a new firewall rule.
- Not for: permanent monitoring – it buries everything else in the Security log.
1. Switch it on for a short time
auditpol /set /subcategory:"{0CCE9226-69AE-11D9-BED3-505054503030}" /success:enable
# ... reproduce what you want to see, then:
auditpol /set /subcategory:"{0CCE9226-69AE-11D9-BED3-505054503030}" /success:disableKeep Failure as it is – that is 5157, the blocked connections, which are worth logging permanently.
2. PowerShell: which programs connected where
Direction: %%14592 = inbound, %%14593 = outbound.
function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156; StartTime=(Get-Date).AddMinutes(-15)} -ErrorAction SilentlyContinue |
ForEach-Object { Get-EventFields $_ } | Where-Object Direction -eq '%%14593' |
Group-Object { Split-Path $_.Application -Leaf }, DestAddress, DestPort | Sort-Object Count -Descending |
Select-Object -First 30 Count, NameFor inbound, group by SourceAddress and DestPort instead: who connects to which of your services.
3. Reading it
- Many outbound connections from
svchost.exe, browsers and update services are normal. - A program you do not know connecting to an address abroad every few minutes is worth checking (file location, signature, what it is).
- Inbound connections to a port you did not expect to be open: find the allow rule behind it (Filter Run-Time ID,
netsh wfp show filters) and decide whether it is needed.
4. Let Coinetic watch it for you
Coinetic watches the network side of this computer for you:
- Port scanners and password guessers are banned automatically by a Windows Firewall rule.
- Open ports at a glance: every listening port, the program behind it and who can reach it through the firewall.
- Outbound control: see which program wanted to go out, and allow or block it with one click.
- Ask AI (Pro + AI): “Is this an attack or just background scanning?”
Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.
More guides: all Coinetic guides.
Frequently asked
Why is my Security log full of 5156?
Someone enabled Filtering Platform Connection for Success, often through an old Group Policy with "Audit object access = Success". Switch Success off and keep only Failure.
What is the difference between 5156 and 5158?
5158 means a program was permitted to bind to a local port (listen), 5156 that a connection was permitted. 5158 is noisy too and rarely needed.
Is there a quieter way to see connections?
For a snapshot, Get-NetTCPConnection shows current connections with the owning process. For history without flooding the log you need a dedicated tool.