I find at a great number of Events 5152 with Protolol 47 in my security Eventlog. (About 380 in the last 10 minutes). The Source Address is the address of my VPN connection. I hoped that Windows Filtering Platform is nothing but another confusing name for Windows Firewall and tried to set up a new inbound rule, where I finally allowed everything for Protocoll 47. But I'm still getting these events. Are thes Events generated by active firewalls or are there other sources. Actually my primary goal is not to allow packages, but to get rid of the messages. Domain rules do not allow me to just shut off auditing of rejected packages. I guess that these lots of useless auditing log is the cause of my (still unsolved Event 21268 /21269 Problem). Thanks Bernd