Event ID 5157: the Windows Filtering Platform has blocked a connection

Event 5157 is the Windows Firewall telling you it blocked a connection: which program, which direction, from which address to which port. It is the most direct record of what knocks on a Server or PC – and of programs that tried to go out and were stopped. It is not on by default, and switching it on the wrong way floods the log.

1. Switch it on (without flooding the log)

As administrator:

auditpol /set /subcategory:"{0CCE9226-69AE-11D9-BED3-505054503030}" /success:disable /failure:enable

The GUID is Filtering Platform Connection – using it instead of the name works on every Windows language. In Group Policy: Computer Configuration › Policies › Windows Settings › Security Settings › Advanced Audit Policy Configuration › Object Access › Audit Filtering Platform Connection = Failure.

Do not tick Success: that writes Event 5156 for every allowed connection – thousands per minute on a busy Server. And make the Security log big enough (several hundred MB on a Server exposed to the internet): blocked connections from internet scanners add up.

2. The fields

Field	Meaning
Application Name	The program, as a device path (\device\harddiskvolume3\...). System for connections to Windows itself (e.g. SMB on 445).
Direction	Inbound = someone tried to reach this computer; Outbound = a program on this computer tried to go out.
Source Address / Port	Where the connection came from (inbound: the other side).
Destination Address / Port	Where it was going (inbound: this computer and the port that was knocked on).
Protocol	6 = TCP, 17 = UDP, 1 = ICMP.
Filter Run-Time ID / Layer	Which firewall filter blocked it. Default-block shows no named rule; a block rule you created can be found with netsh wfp show filters.

3. PowerShell: who knocks, on which ports

As administrator; fields are read by name. The Direction value is a code: %%14592 = inbound, %%14593 = outbound.

function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
$blocked = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5157; StartTime=(Get-Date).AddHours(-1)} -ErrorAction SilentlyContinue |
  ForEach-Object { Get-EventFields $_ }
# inbound: the most blocked addresses and the ports they tried
$blocked | Where-Object Direction -eq '%%14592' | Group-Object SourceAddress |
  Sort-Object Count -Descending | Select-Object -First 15 Count, Name, @{n='Ports';e={($_.Group.DestPort | Sort-Object -Unique) -join ','}}
# outbound: programs that tried to go out and were stopped
$blocked | Where-Object Direction -eq '%%14593' | Group-Object Application | Sort-Object Count -Descending | Select-Object Count, Name

4. How to read what you see

• Many addresses, one or two ports each (3389, 445, 22, 23 ...): normal internet background scanning. The firewall already blocks it – it is not an attack on you in particular.
• One address trying many different ports: a port scan – someone is mapping what is open.
• One address on the same port again and again: a bot that knows the service is (or was) there.
• Outbound blocks from a program you do not know: worth a look – something tried to phone home.
• Blocks on a port you need (e.g. your own application): a missing allow rule, or the network is on the wrong profile (Public instead of Domain).

5. Let Coinetic watch it for you

Coinetic reads these blocked connections for you, all the time:

• Port scanners and repeated knockers are banned automatically by a Windows Firewall rule – background noise is shown as what it is, not as an alarm.
• Outbound control: see which program wanted to go out, and allow or block it with one click.
• Logging kept right: Coinetic switches on what it needs and keeps the Security log size up, without the noisy settings.
• Ask AI (Pro + AI): “Is this an attack or just background scanning?”

More guides: all Coinetic guides.

Frequently asked

Why do I not see any Event 5157?

It is off by default. Switch on the audit subcategory Filtering Platform Connection for Failure (see above). The Windows Firewall log file (pfirewall.log) is a separate setting and does not create these events.

What is the difference between 5157 and 5152?

5157 is a blocked connection (Filtering Platform Connection), 5152 a dropped packet (Filtering Platform Packet Drop). 5152 is much noisier; for most purposes 5157 is enough.

Does 5157 mean I am under attack?

Usually not. Every computer reachable from the internet is scanned all day; 5157 shows the firewall doing its job. Look for one address trying many ports, or for outbound blocks from unknown programs.

Why is the Application Name a \device\harddiskvolume path?

The Filtering Platform works below drive letters. Map the volume to a drive letter with the mountvol command or Get-Partition | Select DriveLetter, AccessPaths, or simply look at the file name at the end of the path.