Windows event ID 5447 - A Windows Filtering Platform filter has been changed

Event ID: 

5447

Category: 

Policy Change

Subcategory: 

Other Policy Change Events

Supported on: 

Windows Vista, Windows Server 2008

A Windows Filtering Platform filter has been changed.

Subject:
Security ID: %2
Account Name: %3

Process Information:
Process ID: %1

Provider Information:
ID: %4
Name: %5

Change Information:
Change Type: %6

Filter Information:
ID: %7
Name: %8
Type: %9
Run-Time ID: %10

Layer Information:
ID: %11
Name: %12
Run-Time ID: %13

Callout Information:
ID: %17
Name: %18

Additional Information:
Weight: %14
Conditions: %15
Filter Action: %16