Solved

Skype Event id 5156 Windows 2008 R2

Posted on 2016-09-04
6
37 Views
Last Modified: 2016-09-10
We have Skype Events id 5156 of audit success in our Windows 2008 R2 each second or each minute. What could be the reason for so many Events id 5156 of Skype? Is there a way to avoid Skype to post so many Events id 5156 on the Event Viewer without damaging works correctly ? Because is not comfortable be filled of garbage each second. This is the example of the Event id where xxx.xxx.xxx.xxx is our static IP:

The Windows Filtering Platform has permitted a connection.

Application Information:
      Process ID:            5772
      Application Name:      \device\harddiskvolume1\program files (x86)\skype\phone\skype.exe

Network Information:
      Direction:            Outbound
      Source Address:            xxx.xxx.xxx.xxx
      Source Port:            12936
      Destination Address:      157.56.52.35
      Destination Port:            40030
      Protocol:            17

Filter Information:
      Filter Run-Time ID:      215063
      Layer Name:            Connect
      Layer Run-Time ID:      48


Sometimes there are events of audit failed but never stops posting.

Thank you
0
Comment
Question by:Alex E.
  • 4
  • 2
6 Comments
 
LVL 18

Expert Comment

by:awawada
ID: 41784108
This is caused because of your Security Auditing policy.

Link

So it is a normal behavior and you need not to worry. Event ID 5156 means that the Firewall is allowing a connection to host.
0
 

Author Comment

by:Alex E.
ID: 41784119
Ok I understand is not bad but is there a way to get rid off of this events? We ask because sometimes we need to monitor Event viewer for other things and like there are thousands of other that kind of events is impossible take a look there.

With get rid off I mean to just remove Skype.exe to be audited the rest of the system is ok just Skype.exe is the issue and filter just for Skype to pos Event id 5156 or 5157 would be wonderful. Any ideas?


Thank you
0
 
LVL 18

Expert Comment

by:awawada
ID: 41784212
Do you use Windows Firewall?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:Alex E.
ID: 41784648
Yes we use of course but we don't want to block the Skype just that events id 5156 and 5157 for Skype only from event viewer.
0
 

Accepted Solution

by:
Alex E. earned 0 total points
ID: 41785060
We solved but we decided for create a custom view in event viewer and then filter that kind of events via XML like this. In that way the Security events of Windows is untouched and the custom view is the one with the filtering. We post just the final XML just in case to other person helps:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*</Select>
    <Suppress Path="Security">*[System[(EventID=5156)]] and *[EventData[Data[@Name='Application'] and (Data ='\device\harddiskvolume1\program files (x86)\skype\phone\skype.exe')]]</Suppress>
    <Suppress Path="Security">*[System[(EventID=5157)]] and *[EventData[Data[@Name='Application'] and (Data ='\device\harddiskvolume1\program files (x86)\skype\phone\skype.exe')]]</Suppress>
  </Query>
</QueryList>

Open in new window


Thank you anyway
0
 

Author Closing Comment

by:Alex E.
ID: 41792499
Thank you
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Knowing where your website is hosted is as important as the features you receive, the monthly fee, and the support you receive. Due diligence should be done when choosing your next hosting provider.
Each year, investment in cloud platforms grows more than 20% (https://www.immun.io/hubfs/Immunio_2016/Content/Marketing/Cloud-Security-Report-2016.pdf?submissionGuid=a8d80a00-6fee-4b85-81db-a4e28f681762) as an increasing number of companies begin to…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question