Windows 10 Event Log > Security Event ID 5156 and 5158 filling it up

  • Thread starter Thread starter esullivanasd
  • Start date Start date
E

esullivanasd

I am trying to use a Powershell scanner in PDQ Inventory (which runs a PS1 and enter the returning data into the asset) that scans the Security log for log on and log off events. The script then enters the data into that asset which allows us to see who has been using it and for how long (we are a school which generic computers all over). These log events are located in the Security logs.In trying to research why we are only getting one MAYBE two user sessions I noticed that logs are getting FILLED with event 5156 and 5158. Upon research it's a log that the Windows Firewall allowed to pass.

Continue reading...
 
You must log in or register to reply here.

Similar threads

J
Windows 11 Windows-Security-LessPrivilegedAppContainer Filling Event Log
Replies
0
Views
6
Jon(S)
J
J
Windows 11 Event id 5038 and Crowdstrike
Replies
0
Views
7
Jeff102365
J
I
Windows 10 Logon Event (Event ID 4648). Events only log during a successful remote desktop in to the computer.
Replies
0
Views
6
ItsChefMatt
I
A
Windows 11 Access denied to event viewer security log - Win11
Replies
0
Views
19
Ashley Beagle
A
H
Windows 10 why are there very many rapidly occurring events in event log?
Replies
0
Views
16
hub-bubba
H
Back
Top