• State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 22 subscribers
  • Views 84 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Windows Filtering Platform Auditing - What if it Never Existed?

FormerMember
FormerMember

Hi All,

We're considering turning off by default the Windows Filtering Platform events from the Security Log that tend to make a whole lot of noise for no really good reason. The only problem we have with this is our policy to date has been "we capture 100% of the Security Log" and we know some people may have legit reasons for using them. Our experience in support, though, tells us that most everyone is happy with turning them off and never seeing them again. emoticons_wink.png We would provide coverage in a second connector, something you could easily enable for many systems using connector profiles (or individually for each system you needed it on).

Do you use Windows Filtering Platform Events? On which systems? What do you use them for? What if we turned them off by default?

  • 0

    I have worked with a large amount of LEM clients over the past 18 months. During that time, I have not had a single client need (or want) anything from WFP events.

    For me, I absolutely LOVE the new setup where we have to turn ON rules with a new installtion (instead of turning OFF things that were not neded). Given that our time with clients is generally short and to the point, it is not always possible to get a GPO-level auditing policy change through an enterprise while working with them. I would strongly support the ability to 'ignore' these events by default with the product and let the client work through their change management to get their auditing policies to stop generating the events in the first place. For the random one-off scenarios with clients who might want to "see all the things!!!", I think a connector would really be ideal, and easy to implement. Functionally speaking, it takes minutes to add a WFP connector to a profile.

    Count me in for a big +1 emoticons_grin.png

    -ZackM

    Loop1 Systems: SolarWinds Training and Professional Services

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.