Aller au contenu principal

I am seeing 15000+ trueimagemonitor security messages in win11 event log

Thread solved

[edit] this belongs in forum 2018, sorry.  Please move to 2018 if possible or necessary

I have never seen "Filtering Platform Connection" messages before.  During a 2 hour period after a reboot I about 20,000 of the 30k are due to trueimagemonitor

There are 1000's of the following messages.  I asked over at microsoft how to stop the event viewer from printing any more.  Sometimes there are 200 in a single second.  about 1/2 to 2/3 are trueimagemonitor.    The following message repeat, sometime the port number changes.

 
 

The Windows Filtering Platform has permitted a connection.

Application Information:
    Process ID:        28032
    Application Name:    \device\harddiskvolume5\program files (x86)\acronis\trueimagehome\trueimagemonitor.exe

Network Information:
    Direction:        Outbound
    Source Address:        127.0.0.1
    Source Port:        51655
    Destination Address:    127.0.0.1
    Destination Port:        6109
    Protocol:        6
    Interface Index:        1
 

The Windows Filtering Platform has permitted a bind to a local port.

Application Information:
    Process ID:        28032
    Application Name:    \device\harddiskvolume5\program files (x86)\acronis\trueimagehome\trueimagemonitor.exe

Network Information:
    Source Address:        0.0.0.0
    Source Port:        51655
    Protocol:        6

[edit] --- I found what caused the log to get spammed.  Malwarebytes turned on audit. However, that does not explain why TrueImageMonitor was looking at all those ports 100s of time as second.  At leat they are not being monitored any more.  I purchased upgrade from 2018 to the subscription end of december.  I do not plan to instal the upgrade unless I can remove the ":security" features. All I am interested in is backup and maintenance of existing TI backups and occasoinal cloning a disk drive.

0 Users found this helpful

Joseph, the latest version of ACPHO (subscription) now permits a Custom Install where you can choose which major components are installed or not.

See  Acronis Cyber Protect Home Office: how to install | Knowledge Base

If anyone runs into the audit spamming problem the following will fix

first - turn off malwarebytes brute force detection else it will turn audit back on

then do the following three items from the admin command prompt

auditpol /Set /Subcategory:"System Integrity" /success:disable
auditpol /Set /Subcategory:"User Account Management" /success:disable
auditpol /Set /Subcategory:"Other System Events" /success:disable

to verify the spamming is disabled, reboot and enter

auditpol /get /Category:*

 

The spamming slowed down my Area51 Dell system terribly.

I could care less if audit is successful, I want to know if it is NOT successful.  I am not sure what mallwarebytes was thinking of when spamming successes.

 

Joseph Stateson wrote:

If anyone runs into the audit spamming problem the following will fix

first - turn off malwarebytes brute force detection else it will turn audit back on

then do the following three items from the admin command prompt

auditpol /Set /Subcategory:"System Integrity" /success:disable
auditpol /Set /Subcategory:"User Account Management" /success:disable
auditpol /Set /Subcategory:"Other System Events" /success:disable

to verify the spamming is disabled, reboot and enter

auditpol /get /Category:*

 

The spamming slowed down my Area51 Dell system terribly.

I could care less if audit is successful, I want to know if it is NOT successful.  I am not sure what malwarebytes was thinking of when spamming successes.  They certainly did a good job of using 30,000+ message to hide a few others that I wanted to see.