Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to enable connection logging with netsh on Vista x64, as shown in this MSDN Article about Firewall troubleshooting...

First, I enabled logging of allowed connections to %systemroot%\system32\LogFiles\Firewall\pfirewall.log, below...

PS C:\Windows\system32> netsh advfirewall set allprofiles logging allowedconnections enable

PS C:\Windows\system32>

Next I check whether logging is really enabled. AFAICT, it is...

PS C:\Windows\system32> netsh advfirewall show currentprofile

Public Profile Settings:
State                                 ON
Firewall Policy                       BlockInbound,AllowOutbound
LocalFirewallRules                    N/A (GPO-store only)
LocalConSecRules                      N/A (GPO-store only)
InboundUserNotification               Enable
RemoteManagement                      Disable
UnicastResponseToMulticast            Enable

LogAllowedConnections                 Enable
LogDroppedConnections                 Disable
FileName                              %systemroot%\system32\LogFiles\Firewall\pfirewall.log
MaxFileSize                           4096


PS C:\Windows\system32>

However, when I try to retrieve the log, I can't...

PS C:\Windows\system32> Get-Content %systemroot%\system32\LogFiles\Firewall\pfirewall.log
Get-Content : Cannot find path 'C:\Windows\system32\%systemroot%\system32\LogFiles\Firewall\pfi
oes not exist.
At line:1 char:12
+ Get-Content <<<<  %systemroot%\system32\LogFiles\Firewall\pfirewall.log
    + CategoryInfo          : ObjectNotFound: (C:\Windows\syst...l\pfirewall.log:String) [Get-C
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
PS C:\Windows\system32>

What else do I need to do to enable connection logging from powershell? I want to avoid rebooting, if at all possible.

share|improve this question
up vote 1 down vote accepted

As you can see, your %systemroot% variable does not get resolved correctly in PowerShell when you retrieve the logfile: Cannot find path 'C:\Windows\system32\%systemroot%\system32\LogFiles\Firewall\pfioes not exist.

In PowerShell, you access environment variables by doing: $env:Variable

Please try this command:

Get-Content $env:systemroot\system32\LogFiles\Firewall\pfirewall.log

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.