Logging windows connections with netsh

Question

I am trying to enable connection logging with netsh on Vista x64, as shown in this MSDN Article about Firewall troubleshooting...

First, I enabled logging of allowed connections to %systemroot%\system32\LogFiles\Firewall\pfirewall.log, below...

PS C:\Windows\system32> netsh advfirewall set allprofiles logging allowedconnections enable
Ok.

PS C:\Windows\system32>

Next I check whether logging is really enabled. AFAICT, it is...

PS C:\Windows\system32> netsh advfirewall show currentprofile

Public Profile Settings:
----------------------------------------------------------------------
State                                 ON
Firewall Policy                       BlockInbound,AllowOutbound
LocalFirewallRules                    N/A (GPO-store only)
LocalConSecRules                      N/A (GPO-store only)
InboundUserNotification               Enable
RemoteManagement                      Disable
UnicastResponseToMulticast            Enable

Logging:
LogAllowedConnections                 Enable
LogDroppedConnections                 Disable
FileName                              %systemroot%\system32\LogFiles\Firewall\pfirewall.log
MaxFileSize                           4096

Ok.

PS C:\Windows\system32>

However, when I try to retrieve the log, I can't...

PS C:\Windows\system32> Get-Content %systemroot%\system32\LogFiles\Firewall\pfirewall.log
Get-Content : Cannot find path 'C:\Windows\system32\%systemroot%\system32\LogFiles\Firewall\pfi
oes not exist.
At line:1 char:12
+ Get-Content <<<<  %systemroot%\system32\LogFiles\Firewall\pfirewall.log
    + CategoryInfo          : ObjectNotFound: (C:\Windows\syst...l\pfirewall.log:String) [Get-C
   ception
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
PS C:\Windows\system32>

What else do I need to do to enable connection logging from powershell? I want to avoid rebooting, if at all possible.

Answer 1

As you can see, your %systemroot% variable does not get resolved correctly in PowerShell when you retrieve the logfile: Cannot find path 'C:\Windows\system32\%systemroot%\system32\LogFiles\Firewall\pfioes not exist.

In PowerShell, you access environment variables by doing: $env:Variable

Please try this command:

Get-Content $env:systemroot\system32\LogFiles\Firewall\pfirewall.log