Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to enable connection logging with netsh on Vista x64, as shown in this MSDN Article about Firewall troubleshooting...

First, I enabled logging of allowed connections to %systemroot%\system32\LogFiles\Firewall\pfirewall.log, below...

PS C:\Windows\system32> netsh advfirewall set allprofiles logging allowedconnections enable
Ok.

PS C:\Windows\system32>

Next I check whether logging is really enabled. AFAICT, it is...

PS C:\Windows\system32> netsh advfirewall show currentprofile

Public Profile Settings:
----------------------------------------------------------------------
State                                 ON
Firewall Policy                       BlockInbound,AllowOutbound
LocalFirewallRules                    N/A (GPO-store only)
LocalConSecRules                      N/A (GPO-store only)
InboundUserNotification               Enable
RemoteManagement                      Disable
UnicastResponseToMulticast            Enable

Logging:
LogAllowedConnections                 Enable
LogDroppedConnections                 Disable
FileName                              %systemroot%\system32\LogFiles\Firewall\pfirewall.log
MaxFileSize                           4096

Ok.

PS C:\Windows\system32>

However, when I try to retrieve the log, I can't...

PS C:\Windows\system32> Get-Content %systemroot%\system32\LogFiles\Firewall\pfirewall.log
Get-Content : Cannot find path 'C:\Windows\system32\%systemroot%\system32\LogFiles\Firewall\pfi
oes not exist.
At line:1 char:12
+ Get-Content <<<<  %systemroot%\system32\LogFiles\Firewall\pfirewall.log
    + CategoryInfo          : ObjectNotFound: (C:\Windows\syst...l\pfirewall.log:String) [Get-C
   ception
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
PS C:\Windows\system32>

What else do I need to do to enable connection logging from powershell? I want to avoid rebooting, if at all possible.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

As you can see, your %systemroot% variable does not get resolved correctly in PowerShell when you retrieve the logfile: Cannot find path 'C:\Windows\system32\%systemroot%\system32\LogFiles\Firewall\pfioes not exist.

In PowerShell, you access environment variables by doing: $env:Variable

Please try this command:

Get-Content $env:systemroot\system32\LogFiles\Firewall\pfirewall.log

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.