Event ID 5165 Spam

Xander Warren 90 Reputation points
2026-11-11T21:49:34.58+00:00

Ever since the new update on November 10th I've notiecd this event 5156 and 5158 in event viewer under security being spammed about 100 times a minute, It's all from my browser, copilot and svchost (I think the svchost is also linked to the browser in some way). I use opera but its not limited to opera as it happens with edge too.

This was not present before the last update and I want to know if this is normal.

Windows for home | Windows 11 | Windows update

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clary-N 19,130 Reputation points Microsoft External Staff Moderator
    2026-11-12T05:34:54.09+00:00

    Hi Xander Warren,

    Since this is a public forum, we will hide your personal identifiable information, and I have modified your question to hide your personal information in the description. Also, please check your private message in case you want to share another screenshot or file to avoid leaking your PII by click on the Message button as show below:

    User's image

    Thanks for sharing the XML details. I understand why seeing so many Security log entries after an update would be concerning.

    The event you posted does not indicate that the connection was blocked. Event ID 5156 is recorded when the Windows Filtering Platform permits a connection, while Event ID 5158 is recorded when an application or service is allowed to bind to a local port. Successful auditing for these events can generate a very large number of entries, sometimes one for every connection made by an application or service.

    In your example, the entries identify Opera as the application and UDP port 5353 as the traffic involved. Since similar entries also appear for Edge, Copilo, and svchost.exe, it would help to confirm whether this is simply increased auditing or whether blocked connections are occurring as well.

    Could you please confirm the following?

    • Are you experiencing any actual browser, network or performance problem, or is the main concern the number of events?
    • Do you also see Event IDs 5157 or 5159? Those IDs indicate blocked connections or blocked port bindings.
    • Are you using a third-party firewall, antivirus, VPN or network-monitoring program?
    • Is this a personal computer or is it managed by a workplace or school?

    Please also share your Windows edition, version and OS build. You can find these under Start > Settings > System > About, in the Windows specifications section.

    If the computer is otherwise working normally and the log contains only permitted events such as 5156 and 5158, the entries are generally informational rather than evidence of a security problem. I would avoid disabling or changing the audit policy for now, particularly if the device is managed, until it is clear what enabled the additional auditing.

    As a small privacy precaution, please remove your Windows username from any file paths before sharing additional XML or screenshots publicly.

    Once you provide the OS build and answers to the questions above, I’ll be happy to help you narrow this down further.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.