See Firewall Activity in Windows Defender Firewall Logs
In this article we'll walk you through the process of enabling logging to help troubleshoot connection issues related to the Windows Firewall.
You can find this information on a target by enabling logging of dropped packets while replicating the steps in PDQ Deploy or Inventory that caused the error or connection problem.
Enable manually
To manually enable logging dropped packets on a failing target:
- Launch the Windows Firewall Console on the Target Computer.
- Select the Windows Defender Firewall tab and click Properties in the Actions menu.
- Inside the Properties tab, select the Customize button under Logging.
- Select Yes in the Log Dropped Packets dropdown menu.
- Press OK to close the Logging Settings menu and again to close the Windows Defender Firewall Properties.
Enable with PowerShell
If desired, you can enable logging of dropped packets with PowerShell instead of using the Windows Firewall Console:
Set-NetFirewallProfile -Profile Domain -LogBlocked True
Access the logs
Once logging is enabled, verify you are able to read the log file. If not, open the Log Files Security tab and enable Read permissions for your account.
You can find the logs at the following path: C:\Windows\System32\LogFiles\Firewall
By default, the log is named pfirewall.log.
After verifying the log can be opened and read, attempt to replicate the error received. You may need to close and reopen the file after each test to see updates.
Troubleshoot when the Domain firewall shows no dropped packets
If you do not see any dropped packets while logging the Domain firewall, turn off Domain logging and repeat the steps to log the Private and Public firewall profiles instead, one at a time.
To enable logging for the other firewall profiles (Private and Public), first disable any previously enabled logging. You may either perform the manual UI steps above in reverse order, or you can disable it with the following PowerShell command:
Set-NetFirewallProfile -Profile Domain -LogBlocked False
