I have Server 2012 DC that I noticed recently as having thousands of 5145 events being logged. In my research this event is logged for any access to any file share and this audit is not important for our company's police
and this advanced audit item is not configured on any GPO applying to the DC
after a lot of search in the internet i found some command to stop the auditing for both Filtering Platform & File Share :
auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable
auditpol /set /subcategory:"Detailed File Share" /success:disable /failure:disable
this 2 command is work fine and all auditing for Filtering Platform & File Share are stopped (I feel good now).
but the problem is after some time one hours or more I'm not sure the auditing for Filtering Platform & File Share is return back and the thousands of 5145 events return back
so can any one help me to stop auditing for Filtering Platform & File Share.
and this advanced audit item is not configured on any GPO applying to the DC
after a lot of search in the internet i found some command to stop the auditing for both Filtering Platform & File Share :
auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable
auditpol /set /subcategory:"Detailed File Share" /success:disable /failure:disable
this 2 command is work fine and all auditing for Filtering Platform & File Share are stopped (I feel good now).
but the problem is after some time one hours or more I'm not sure the auditing for Filtering Platform & File Share is return back and the thousands of 5145 events return back
so can any one help me to stop auditing for Filtering Platform & File Share.