Security event id 5159 problem on Windows 2008

[Richard Hrubizna]

Hi I have a following problem,
every 30 seconds on Windows 2008 SP1 x64 on our HP Proliant DL 385 G5 server with PSP 8.11 installed is event id 5159 (Audit Failure) with following informantions generated.

Event id 5159
The Windows Filtering Platform has bloked a bind to a local port.
Applicatoin Information:
Process ID: 2928
Application Name: \device\hardiskvolume1\windows\system32\cpqmgmt\cqmghost\cqmghost.exe

Network Infromation:
Source Address: 0.0.0.0
Source Port: 50724
Protocol : 17

Filter Information:
Filter Run-Time ID: 0
Layer Name: Resource Assigment
Layer Run-Time ID: 36

Windows Firewall is off. The event stops when we stop HP Foundation Agents service. Thanks.

[KarloChacon]

hi

try a previous version for Insight agents
- go to add and remove programs and remove HP insight management agents and install this previous version

http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=15351&prodSeriesId=3646113&prodNameId=3646114&swEnvOID=4024&swLang=8&taskId=135&swItem=MTX-495c0e1cdbe940cb922c7bd625&mode=3

bye

[stevenice]

I tried rolling back to the 8.10 Management agents but am still having the problem on two different servers. It logs an audit failure event in the windows security log every 10 seconds. The windows firewall is also turned off on my systems.

Any help would be appreciated..

[Richard Hrubizna]

Rolling back to the 8.10 Management agents didn't solved the problem for me either. Stevenice , do you also have 64-bit system ? Because on 32-bit system I do not have such a problem.

[stevenice]

I am having the problem on two different servers, one is 32 bit and one is 64 bit.

[jonwayne]

Folks,

Has anyone gotten any feed back from HP Support on this reported issue, and what is HP's plans for providing a patch for this known issue with HP Insight Foundation Agent running on Windows Server 2008?

Thanks much!