?
Solved

Skype Event id 5156 Windows 2008 R2

Posted on 2016-09-04
6
Medium Priority
?
63 Views
Last Modified: 2016-09-10
We have Skype Events id 5156 of audit success in our Windows 2008 R2 each second or each minute. What could be the reason for so many Events id 5156 of Skype? Is there a way to avoid Skype to post so many Events id 5156 on the Event Viewer without damaging works correctly ? Because is not comfortable be filled of garbage each second. This is the example of the Event id where xxx.xxx.xxx.xxx is our static IP:

The Windows Filtering Platform has permitted a connection.

Application Information:
      Process ID:            5772
      Application Name:      \device\harddiskvolume1\program files (x86)\skype\phone\skype.exe

Network Information:
      Direction:            Outbound
      Source Address:            xxx.xxx.xxx.xxx
      Source Port:            12936
      Destination Address:      157.56.52.35
      Destination Port:            40030
      Protocol:            17

Filter Information:
      Filter Run-Time ID:      215063
      Layer Name:            Connect
      Layer Run-Time ID:      48


Sometimes there are events of audit failed but never stops posting.

Thank you
0
Comment
Question by:Alex E.
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 18

Expert Comment

by:awawada
ID: 41784108
This is caused because of your Security Auditing policy.

Link

So it is a normal behavior and you need not to worry. Event ID 5156 means that the Firewall is allowing a connection to host.
0
 

Author Comment

by:Alex E.
ID: 41784119
Ok I understand is not bad but is there a way to get rid off of this events? We ask because sometimes we need to monitor Event viewer for other things and like there are thousands of other that kind of events is impossible take a look there.

With get rid off I mean to just remove Skype.exe to be audited the rest of the system is ok just Skype.exe is the issue and filter just for Skype to pos Event id 5156 or 5157 would be wonderful. Any ideas?


Thank you
0
 
LVL 18

Expert Comment

by:awawada
ID: 41784212
Do you use Windows Firewall?
0
Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

 

Author Comment

by:Alex E.
ID: 41784648
Yes we use of course but we don't want to block the Skype just that events id 5156 and 5157 for Skype only from event viewer.
0
 

Accepted Solution

by:
Alex E. earned 0 total points
ID: 41785060
We solved but we decided for create a custom view in event viewer and then filter that kind of events via XML like this. In that way the Security events of Windows is untouched and the custom view is the one with the filtering. We post just the final XML just in case to other person helps:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*</Select>
    <Suppress Path="Security">*[System[(EventID=5156)]] and *[EventData[Data[@Name='Application'] and (Data ='\device\harddiskvolume1\program files (x86)\skype\phone\skype.exe')]]</Suppress>
    <Suppress Path="Security">*[System[(EventID=5157)]] and *[EventData[Data[@Name='Application'] and (Data ='\device\harddiskvolume1\program files (x86)\skype\phone\skype.exe')]]</Suppress>
  </Query>
</QueryList>

Open in new window


Thank you anyway
0
 

Author Closing Comment

by:Alex E.
ID: 41792499
Thank you
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
What's worse than having your data encrypted by ransomware? Getting attacked by a so-called "wiper," which simply destroys the data and offers you no hope of ever seeing it again.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question