I am going through some event logs (in event viewer), and noticed I can't seem to find any firewall logs. Windows Defender provides the firewall. How do I get to the firewall logs that should be generated by Windows Defender, or are they not even generated? I have searched through event viewer, the Windows Defender firewall GUI, and google searches have been unsuccessful (they generally point to older versions of Windows not using Windows Defender)!

  • I'm voting to close this question as off-topic because this should have been migrated to SuperUser
    – schroeder
    Mar 2, 2020 at 21:15

1 Answer 1


Applies to

  • Windows 10
  • Windows Server 2016

To configure Windows Firewall to log dropped packets or successful connections, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in.

Administrative credentials

To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.

To configure the Windows Firewall log

  1. Open the Group Policy Management Console to Windows Firewall with Advanced Security (found in Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security).

  2. In the details pane, in the Overview section, click Windows Firewall Properties.

    For each network location type (Domain, Private, Public), perform the following steps:

    1. Click the tab that corresponds to the network location type.

    2. Under Logging, click Customize.

    3. The default path for the log is %windir%\system32\logfiles\firewall\pfirewall.log. If you want to change this, clear the "Not configured" check box and type the path to the new location, or click "Browse" to select a file location.

      Important: The location you specify must have permissions assigned that permit the Windows Firewall service to write to the log file.

    4. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this, clear the Not configured check box, and type in the new size in KB, or use the up and down arrows to select a size. The file will not grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones.

    5. No logging occurs until you set one of following two options:

      To create a log entry when Windows Firewall drops an incoming network packet, change "Log dropped packets" to "Yes."

      To create a log entry when Windows Firewall allows an inbound connection, change "Log successful connections" to "Yes."

    Click OK twice.


If you have any more questions you can see this whole guide and read more into it here:


Hopefully this helps you solve your problem!

  • Good to know that firewall logging doesn't occur unless you explicitly set it up. I would have thought it would be set to log by default. Would be nice if Windows and other products built more security in, like this for example.
    – Jonathan
    Aug 5, 2017 at 15:48
  • To go into more detail on step #3, you must grant the "NT Service\MpsSvc" service write permission to the folder you choose (if the folder doesn't exist, you may have to create it and then add this permission).
    – gkubed
    Mar 17 at 14:08

Not the answer you're looking for? Browse other questions tagged .