Windows Firewall Logs — How to Enable, Find and Read Them

Windows Defender Firewall can record every connection it allows or drops — but logging is disabled by default, so on a machine where nobody enabled it, there is nothing to read. Turning it on is the first step, and it must be done per network profile.

Enabling Logging

Through the GUI

1. Open Windows Defender Firewall with Advanced Security — run wf.msc.
2. Right-click Windows Defender Firewall with Advanced Security in the left pane → Properties.
3. Pick a profile tab: Domain, Private or Public.
4. Under Logging, click Customize…
5. Set Log dropped packets and Log successful connections to Yes.
6. Note the log path and raise the size limit — 4096 KB is the default and fills quickly.
7. Repeat for each profile. Settings are per-profile, and a laptop switching networks changes profile.

Through PowerShell (faster, and covers all three profiles)

Set-NetFirewallProfile -Profile Domain,Private,Public `
  -LogAllowed True -LogBlocked True `
  -LogFileName "%systemroot%\system32\LogFiles\Firewall\pfirewall.log" `
  -LogMaxSizeKilobytes 32767

# Confirm
Get-NetFirewallProfile | Select-Object Name, LogAllowed, LogBlocked, LogFileName, LogMaxSizeKilobytes

Through netsh

netsh advfirewall set allprofiles logging droppedconnections enable
netsh advfirewall set allprofiles logging allowedconnections enable
netsh advfirewall set allprofiles logging maxfilesize 32767

Where the Log Lives

%systemroot%\system32\LogFiles\Firewall\pfirewall.log

Typically C:\Windows\System32\LogFiles\Firewall\pfirewall.log. When the file reaches its size limit it is renamed pfirewall.log.old and a fresh one starts — so you always have between one and two files’ worth of history, and no more.

You need administrator rights to read it, and Notepad will often refuse while the file is in use. Copy it first:

Copy-Item C:\Windows\System32\LogFiles\Firewall\pfirewall.log $env:TEMP\fw.log
notepad $env:TEMP\fw.log

Reading the Format

#Fields: date time action protocol src-ip dst-ip src-port dst-port size
         tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path

2026-08-28 09:14:22 DROP TCP 203.0.113.44 192.168.1.20 51234 3389 52 S 1234567 0 8192 - - - RECEIVE
2026-08-28 09:14:25 ALLOW TCP 192.168.1.20 142.250.185.78 49876 443 0 - 0 0 0 - - - SEND

The two entries above read as: someone at 203.0.113.44 tried to open RDP (port 3389) on this machine and was blocked; then this machine made an outbound HTTPS connection, which was allowed.

INFO-EVENTS-LOST means logging could not keep up and entries were discarded — usually a sign the log level is too verbose for the machine’s activity.

Filtering With PowerShell

The raw file is unusable by hand on a busy machine. Parse it:

$log = "C:\Windows\System32\LogFiles\Firewall\pfirewall.log"

# Everything that was dropped
Get-Content $log | Select-String " DROP "

# Inbound drops only — attempts against this machine
Get-Content $log | Select-String " DROP " | Select-String "RECEIVE"

# Anything involving one address
Get-Content $log | Select-String "203.0.113.44"

# Attempts on RDP
Get-Content $log | Select-String " 3389 "

# Watch live
Get-Content $log -Wait -Tail 20

For real analysis, convert it into objects:

$entries = Get-Content $log |
  Where-Object { $_ -notmatch '^#' -and $_.Trim() } |
  ForEach-Object {
    $f = $_ -split '\s+'
    [PSCustomObject]@{
      Time     = "$($f[0]) $($f[1])"
      Action   = $f[2]
      Protocol = $f[3]
      SrcIP    = $f[4]
      DstIP    = $f[5]
      DstPort  = $f[7]
      Path     = $f[16]
    }
  }

# Top sources of blocked inbound traffic
$entries | Where-Object { $_.Action -eq 'DROP' -and $_.Path -eq 'RECEIVE' } |
  Group-Object SrcIP | Sort-Object Count -Descending | Select-Object -First 20

# Most-targeted ports
$entries | Where-Object { $_.Action -eq 'DROP' } |
  Group-Object DstPort | Sort-Object Count -Descending | Select-Object -First 20

What You Will Actually See

Getting the Process Name

The firewall log’s biggest limitation is that it does not name the process — you get addresses and ports and nothing about what generated the traffic. For that, use the Windows Filtering Platform audit events:

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable
auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable

Then read them from the Security log:

# 5156 = allowed connection, 5157 = blocked connection
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=5157} -MaxEvents 50 |
  Select-Object TimeCreated, Message | Format-List

These events include the application path, which the text log does not. They are also considerably more verbose, so enable them for investigation rather than permanently.

Practical Notes

• Raise the size limit. The 4096 KB default rotates within hours on an active machine, and the history you want is usually the part that just got overwritten.
• Enable it on all three profiles. A laptop that moves between office and home changes profile, and unlogged profiles record nothing.
• Log allowed connections only while investigating. It generates a great deal of volume; dropped-only is the sensible steady state.
• Ship the logs somewhere. Local files rotate away and are lost if the machine is compromised. Forward to a SIEM if you have one.
• Deploy the settings by Group Policy rather than per machine, so coverage is consistent.
• Blocked inbound traffic is normal. The firewall doing its job is not an incident. Look for patterns and for unexpected outbound connections.

Frequently Asked Questions

Where is the Windows Firewall log file?

C:\Windows\System32\LogFiles\Firewall\pfirewall.log by default, with the previous file kept as pfirewall.log.old. Administrator rights are required to read it.

Why is my firewall log empty or missing?

Logging is off by default. Enable it per profile in wf.msc under Properties → Logging → Customize, or with Set-NetFirewallProfile.

Does the log show which program made a connection?

No. The text log has addresses, ports and protocol only. For the process name, enable Filtering Platform auditing with auditpol and read Security log events 5156 and 5157.

How long are logs kept?

Only until the size limit is reached, at which point the file rotates. There is no time-based retention, so a busy machine may hold only hours of history. Raise the limit or forward the logs elsewhere.

Should I log allowed connections?

Only while troubleshooting or investigating. It produces far more volume than dropped-only logging and will rotate away the entries you care about.

Are all these blocked connections an attack?

Constant inbound drops on 3389, 445 and 22 are ordinary internet background scanning against any exposed host, and the firewall is working correctly. Unexpected outbound connections deserve more attention.