The security log is now full (Windows 11 Only)

Hi Ramesh,

We are using Microsoft Defender for endpoints. the issue come in only Windows 11 22H2 version.

The behavior of GPO also changed in this version.

In windows 11 21H2 behavior of GPO is not changing.

We set GPO settings as "overwrite event as needed"

it's automatically changed from overwrite event as needed to "do not overwrite events"

Hi, Yusuf,

I don't work for microsoft, just a fellow user trying to figure out what is wrong, sharing data so maybe we can figure this out as a community... I have no insight into what MS did/what's causing this.

George

Hi Yusuf,

Maybe you have installed Malwarebytes (or a similar security program) and enabled the Brute Force option? Anyway, you may want to check out Disable “Filtering Platform Connection” (Event ID 5156, 5158) Security Logging

Thanks, George,

Your information is helpful! we are also investigating the security logs files and find 90% of the log problem is 'Filtering Platform Connection' event id 5156 is generating.

Can you explain to me what the cause is it's happening in only windows 11 and GPO behavior also changed?

I am having the same issue on numerous windows 11 laptops, including my own.

I downloaded the security event log (23000 entries/40MB) to csv, open in excel, pivot to find that it filled up on 11/29 with the following messages.

• Event 5447 A Windows Filtering Platform filter has been changed. 63% of messages
• Event 5449 A Windows Filtering Platform provider context has been changed. 28% of messages.
• so 90% of the log problem is 'windows filtering platform'

I found this issue and fix reported years ago, to disable auditing for : https://social.technet.microsoft.com/Forums/en-US/0eac969a-ddee-4e16-a557-23edd00c6fc8/security-log-filling-up-with-event-id-5447-on-windows-2008r2-dc?forum=winserverPN

The interesting bit:

Since event 5447 belong to "other policy change events" audit subcategory.
Run command below to show the audit policy status:
auditpol /get /subcategory:"other policy change events"

Run command below to disable the audit policy:
auditpol /set /subcategory:"other policy change events" /success:disable /failure:disable

If there are more inquiries on this issue, please feel free to let us know.

But things have changed since November...

I expanded the size of the file log file and rebooted a couple of times on 1/25/2023. This time, I'm getting different results.

Each reboot adds 25,000 entries to the log file (about 40MB worth).

The majority (76%) of issues in the log file are 4673, use of sensitive privileges. They all refer to 'teams.exe'.

re. the teams issue, this article may give us an option:

https://learn.microsoft.com/en-us/answers/questions/1144610/event-id-4673-for-teams-exe-and-msedge-exe

The interesting bit:

Here is the information that I wanted to discuss with you today:
After researching the issue, my team and I have found that this is a known issue that is not unique to Teams or Edge. This issue occurs with Chrome and Chromium applications. The issue occurs with Chromium-based applications if their default configurations are changed. 

At this time, there are three options to move forward:

1. You can permit SeProfileSingleProcessPrivilege for users.
2. You can disable the failure audits.
3. You can continue to monitor with the high volume of events being generated.