Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have read many similar articles and posts on how to enable windows firewall logging. I have Win2k8r2 server without any Active Directory, DC, domains and other complicated stuff. Almost all of this article references to GPO and enabling it. The issue I even don't have it in my system. I tried to invoke "gpmc.msc" from my console but it seems I should intall it before using.

Then I set a windows firewall log file location to D:\pfirewalll.log. It creates two files: prifrewall.log and pfirewall.log.old. These have any necessary file system permissions. And they are always blank!

I don't know is there any other mechanisms to turn it on. Should I leverage something in windows registry to make it alive?

Thanks in advance, guys!

share|improve this question
    
Try stopping and restarting the Windows Firewall service. Then try accessing the server from another machine via RDP, UNC, etc. and then check the firewall log. –  joeqwerty May 22 '12 at 13:32
    
@joeqwerty I have access to that server only thru RDP. Will I save access if I restart firewall service? –  kseen May 22 '12 at 14:00
    
You may lose your connection for a minute but you should be able to reconnect. From the Services applet, select the service, then click the restart button. This will stop then restart the service. –  joeqwerty May 22 '12 at 15:04

2 Answers 2

There are 3 profiles available (domain/private/public). You can view which is "active" on the top node "Windows Firewall with Advanced Security" of the MMC. Please ensure the profile that is active is the one you enabled and configure the firewall logging for. You can configure the settings the same for all 3 profiles or have a unique configuration for each.

share|improve this answer
    
Jacob, you are a Windows god. I totally missed that. –  user64141 Dec 4 at 21:31

In the Firewall UI, where you configured logging, have you set it to actually log the packets?

-> "Log dropped packets" and "Log successful connections" to YES?

share|improve this answer
    
Of course, I did set "Log dropped packets" and "Log successful connections". –  kseen May 22 '12 at 8:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.