I am seeing 15000+ trueimagemonitor security messages in win11 event log
[edit] this belongs in forum 2018, sorry. Please move to 2018 if possible or necessary
I have never seen "Filtering Platform Connection" messages before. During a 2 hour period after a reboot I about 20,000 of the 30k are due to trueimagemonitor
There are 1000's of the following messages. I asked over at microsoft how to stop the event viewer from printing any more. Sometimes there are 200 in a single second. about 1/2 to 2/3 are trueimagemonitor. The following message repeat, sometime the port number changes.
The Windows Filtering Platform has permitted a connection.
Application Information:
Process ID: 28032
Application Name: \device\harddiskvolume5\program files (x86)\acronis\trueimagehome\trueimagemonitor.exe
Network Information:
Direction: Outbound
Source Address: 127.0.0.1
Source Port: 51655
Destination Address: 127.0.0.1
Destination Port: 6109
Protocol: 6
Interface Index: 1
The Windows Filtering Platform has permitted a bind to a local port.
Application Information:
Process ID: 28032
Application Name: \device\harddiskvolume5\program files (x86)\acronis\trueimagehome\trueimagemonitor.exe
Network Information:
Source Address: 0.0.0.0
Source Port: 51655
Protocol: 6
[edit] --- I found what caused the log to get spammed. Malwarebytes turned on audit. However, that does not explain why TrueImageMonitor was looking at all those ports 100s of time as second. At leat they are not being monitored any more. I purchased upgrade from 2018 to the subscription end of december. I do not plan to instal the upgrade unless I can remove the ":security" features. All I am interested in is backup and maintenance of existing TI backups and occasoinal cloning a disk drive.


- Log in to post comments
If anyone runs into the audit spamming problem the following will fix
first - turn off malwarebytes brute force detection else it will turn audit back on
then do the following three items from the admin command prompt
auditpol /Set /Subcategory:"System Integrity" /success:disable
auditpol /Set /Subcategory:"User Account Management" /success:disable
auditpol /Set /Subcategory:"Other System Events" /success:disable
to verify the spamming is disabled, reboot and enter
auditpol /get /Category:*
The spamming slowed down my Area51 Dell system terribly.
I could care less if audit is successful, I want to know if it is NOT successful. I am not sure what mallwarebytes was thinking of when spamming successes.
- Log in to post comments
Joseph Stateson wrote:If anyone runs into the audit spamming problem the following will fix
first - turn off malwarebytes brute force detection else it will turn audit back on
then do the following three items from the admin command prompt
auditpol /Set /Subcategory:"System Integrity" /success:disable
auditpol /Set /Subcategory:"User Account Management" /success:disable
auditpol /Set /Subcategory:"Other System Events" /success:disableto verify the spamming is disabled, reboot and enter
auditpol /get /Category:*
The spamming slowed down my Area51 Dell system terribly.
I could care less if audit is successful, I want to know if it is NOT successful. I am not sure what malwarebytes was thinking of when spamming successes. They certainly did a good job of using 30,000+ message to hide a few others that I wanted to see.
- Log in to post comments