Event Log > Security Event ID 5156 and 5158 filling it up

[esullivanasd]

I am trying to use a Powershell scanner in PDQ Inventory (which runs a PS1 and enter the returning data into the asset) that scans the Security log for log on and log off events. The script then enters the data into that asset which allows us to see who has been using it and for how long (we are a school which generic computers all over). These log events are located in the Security logs.In trying to research why we are only getting one MAYBE two user sessions I noticed that logs are getting FILLED with event 5156 and 5158. Upon research it's a log that the Windows Firewall allowed to pass.

Continue reading...