6

I have read many similar articles and posts on how to enable windows firewall logging. I have Win2k8r2 server without any Active Directory, DC, domains and other complicated stuff. Almost all of this article references to GPO and enabling it. The issue I even don't have it in my system. I tried to invoke "gpmc.msc" from my console but it seems I should intall it before using.

Then I set a windows firewall log file location to D:\pfirewalll.log. It creates two files: prifrewall.log and pfirewall.log.old. These have any necessary file system permissions. And they are always blank!

I don't know is there any other mechanisms to turn it on. Should I leverage something in windows registry to make it alive?

Thanks in advance, guys!

  • Try stopping and restarting the Windows Firewall service. Then try accessing the server from another machine via RDP, UNC, etc. and then check the firewall log. – joeqwerty May 22 '12 at 13:32
  • @joeqwerty I have access to that server only thru RDP. Will I save access if I restart firewall service? – kseen May 22 '12 at 14:00
  • You may lose your connection for a minute but you should be able to reconnect. From the Services applet, select the service, then click the restart button. This will stop then restart the service. – joeqwerty May 22 '12 at 15:04
7

There are 3 profiles available (domain/private/public). You can view which is "active" on the top node "Windows Firewall with Advanced Security" of the MMC. Please ensure the profile that is active is the one you enabled and configure the firewall logging for. You can configure the settings the same for all 3 profiles or have a unique configuration for each.

  • Jacob, you are a Windows god. I totally missed that. – user64141 Dec 4 '14 at 21:31
0

In the Firewall UI, where you configured logging, have you set it to actually log the packets?

-> "Log dropped packets" and "Log successful connections" to YES?

  • Of course, I did set "Log dropped packets" and "Log successful connections". – kseen May 22 '12 at 8:22
0

I've found that log viewers like CM Trace or Trace 32 have trouble viewing anything more than the firewall log headers. If you open it with notepad I think you'll find that it's logging properly.

  • I haven't tried anything besides of Notepad. Notepad was showing empty file. – kseen Aug 5 '16 at 17:17
0

One thing to check: is the file >0KB? If so, it seems several applications aren't checking READ permission, and instead just displaying an "empty" file.

The file was always being created 'inherit security permissions' turned off, and explicitly had no read access for my user account (despite being local admin).

After explicitly adding my user account, I can open and view contents.

However, if Windows recreates the log again (following reboot, or changing log settings), the permissions are reverted back.

0

In my case, it happened after promoting a Windows 2012R2 as a Domain Controller.

Adding the NT SERVICE\MPSSVC account with Full Controll permissions on the C:\Windows\System32\LogFiles\Firewall folder and restarting the server solved my problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.