When a connection fails and you suspect the firewall, or you want to see who’s knocking on your server’s ports, Windows Firewall logging gives you the answer. By default, logging is off. Turning it on records dropped (and optionally allowed) packets in a plain-text log you can search and analyze.

Enable logging in the GUI

  1. Run wf.msc (Windows Defender Firewall with Advanced Security).
  2. Right-click Windows Defender Firewall with Advanced Security on Local Computer → Properties.
  3. For each profile tab (Domain, Private, Public), under Logging, click Customize…:
    • Name: %systemroot%\system32\LogFiles\Firewall\pfirewall.log (default);
    • Size limit: raise it from 4 MB to e.g. 32 MB (32767 KB maximum);
    • Log dropped packets: Yes;
    • Log successful connections: Yes only while troubleshooting (it’s noisy).
  4. Click OK.

On a VPS, make sure the Public profile has logging enabled, since that’s usually the active one.

Enable logging with PowerShell

Set-NetFirewallProfile -Profile Domain,Private,Public `
  -LogFileName "%systemroot%\system32\LogFiles\Firewall\pfirewall.log" `
  -LogMaxSizeKilobytes 32767 -LogBlocked True -LogAllowed False

Get-NetFirewallProfile | Format-Table Name, LogBlocked, LogAllowed, LogFileName, LogMaxSizeKilobytes

Or with netsh:

netsh advfirewall set allprofiles logging droppedconnections enable
netsh advfirewall set allprofiles logging maxfilesize 32767

Where is the log?

C:\Windows\System32\LogFiles\Firewall\pfirewall.log

When it reaches the size limit, it’s renamed to pfirewall.log.old, and a new file starts (only one old file is kept). If the file doesn’t appear, check that logging is enabled for the active profile, and that the Windows Defender Firewall service account can write to the folder. Opening it requires administrator rights.

Reading the log

Each line has a fixed set of fields:

#Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path
2026-04-12 09:14:03 DROP TCP 185.220.101.7 203.0.113.10 51544 3389 52 S 1203411 0 64240 - - - RECEIVE
2026-04-12 09:14:05 ALLOW TCP 203.0.113.10 93.184.216.34 50122 443 0 - 0 0 0 - - - SEND
Field Meaning
action DROP or ALLOW
protocol TCP, UDP, ICMP
src-ip / src-port Where it came from
dst-ip / dst-port Where it was going (your server’s port, for inbound)
path RECEIVE (inbound) or SEND (outbound)

A burst of DROPs to port 3389 from many IPs is typical RDP scanning. A DROP of the connection your app needs means a missing allow rule.

Analyze with PowerShell

$log = "$env:SystemRoot\System32\LogFiles\Firewall\pfirewall.log"

# Live view (like tail -f)
Get-Content $log -Wait -Tail 20

# Parse into objects
$entries = Get-Content $log | Where-Object { $_ -and $_ -notmatch '^#' } | ForEach-Object {
  $f = $_ -split ' '
  [pscustomobject]@{ Date=$f[0]; Time=$f[1]; Action=$f[2]; Proto=$f[3]; Src=$f[4]; Dst=$f[5]; DstPort=$f[7]; Path=$f[16] }
}

# Top blocked destination ports
$entries | Where-Object Action -eq 'DROP' | Group-Object DstPort | Sort-Object Count -Descending | Select-Object -First 10 Count, Name

# Top source IPs being blocked
$entries | Where-Object Action -eq 'DROP' | Group-Object Src | Sort-Object Count -Descending | Select-Object -First 10 Count, Name

Troubleshoot a blocked app

  1. Enable dropped packet logging.
  2. Reproduce the problem (try connecting).
  3. Search for the port: Select-String -Path $log -Pattern ' 8080 '.
  4. If you see DROP lines, add an allow rule for that port or program. See allowing an app through Windows Firewall.
  5. No DROP lines? The firewall isn’t blocking it. Check that the app listens on the right address, and check network firewalls upstream.

Audit rule changes with Event Viewer

The text log records packets, not configuration changes. Rule changes are logged in Event Viewer → Applications and Services Logs → Microsoft → Windows → Windows Firewall With Advanced Security → Firewall:

Event ID Meaning
2004 / 2097 Rule added
2005 / 2099 Rule modified
2006 / 2052 Rule deleted
2003 Profile setting changed

For connection-level auditing in the Security log (event 5152 “packet dropped”, 5157 “connection blocked”), enable the audit policy:

auditpol /set /subcategory:"Filtering Platform Packet Drop" /failure:enable
auditpol /set /subcategory:"Filtering Platform Connection" /failure:enable

These generate many events. Enable them temporarily. See Windows Event Viewer errors.

Good practice on servers

  • Keep dropped-packet logging on, with a large size limit, so you have evidence when something goes wrong.
  • Don’t leave “log successful connections” on permanently: it fills the log in minutes on a busy server.
  • Use the log to spot scanning of RDP, SMB or database ports, and tighten rules: restrict RDP to your IPs. See Windows Firewall rules.
  • Forward logs to a central system if you manage several servers.

Quick reference

Task Command
Enable (all profiles) Set-NetFirewallProfile -Profile Domain,Private,Public -LogBlocked True
Bigger log -LogMaxSizeKilobytes 32767
Log location C:\Windows\System32\LogFiles\Firewall\pfirewall.log
Live view Get-Content $log -Wait -Tail 20
Rule-change events Event Viewer → Windows Firewall With Advanced Security

Related: Windows VPS hosting and changing the RDP port.

  • Windows
  • Firewall
  • Logs