在防火墙closures的情况下在事件日志中获取Windows Filtering Platform事件是否正常？ 我在Windows Server 2008 R2 Service Pack 1上。
例如，我得到了像这样的多个5156事件：
The Windows Filtering Platform has permitted a connection. Application Information: Process ID: 6012 Application Name: \device\harddiskvolume1\localdomain\syslog\localdomainsyslogserver.exe Network Information: Direction: Outbound Source Address: 127.0.0.1 Source Port: 52207 Destination Address: 127.0.0.1 Destination Port: 1433 Protocol: 6 Filter Information: Filter Run-Time ID: 0 Layer Name: Connect Layer Run-Time ID: 48 而“netsh advfirewall”显示这一点：
C:\>netsh advfirewall show allprofiles state Domain Profile Settings: ---------------------------------------------------------------------- State OFF Private Profile Settings: ---------------------------------------------------------------------- State OFF Public Profile Settings: ---------------------------------------------------------------------- State OFF Ok.
我知道我可以删除它正在改变审计政策。