How to Enable Log Success Connections in Windows Defender Firewall via Intune

Start by signing into the Microsoft Intune admin center where you'll create the firewall policy. This is where all endpoint security configurations are managed.

Open your web browser and navigate to https://intune.microsoft.com. Sign in with your administrative credentials that have Intune Service Administrator or Global Administrator permissions.

Once logged in, navigate to Endpoint security in the left navigation pane, then click Firewall. You'll see any existing firewall policies listed here.

Click Create policy to start creating a new firewall configuration policy.

Choose the correct platform and profile template to ensure compatibility with your target devices. The selection here determines which settings will be available.

In the "Create a policy" blade:

• Select Platform: Windows 10, Windows 11, and Windows Server
• Select Profile: Microsoft Defender Firewall
• Click Create

This profile template provides access to the new logging settings introduced for Windows Defender Firewall management through Intune.

Provide clear identification for your firewall policy to make it easily recognizable in your Intune environment. Good naming conventions help with policy management and troubleshooting.

Fill in the following fields:

• Name: Enable Firewall Success Connection Logging
• Description: Enables logging of successful network connections across all firewall profiles for compliance monitoring and forensic analysis

The name should clearly indicate the policy's purpose, especially since you may have multiple firewall policies in your environment.

Click Next to proceed to the configuration settings.

Configure logging settings for the Domain profile, which applies when devices are connected to your corporate domain network. This profile typically has the most restrictive settings.

Expand the Domain profile section and configure these settings:

• Enable log success connections: Yes
• Log file path: C:\Windows\System32\LogFiles\Firewall\pfirewall.log
• Enable log dropped packets: Yes (recommended for comprehensive logging)
• Log max file size (KB): 4096
• Enable log ignored rules: Yes

These settings ensure that all successful inbound connections, dropped packets, and ignored rules are logged to the specified file path.

Apply the same logging configuration to Private and Public profiles to ensure consistent logging across all network environments. These profiles handle home networks and public Wi-Fi connections respectively.

Expand the Private profile section and configure:

• Enable log success connections: Yes
• Log file path: C:\Windows\System32\LogFiles\Firewall\pfirewall.log
• Enable log dropped packets: Yes
• Log max file size (KB): 4096
• Enable log ignored rules: Yes

Repeat the same configuration for the Public profile section with identical settings.

Using the same log file path across all profiles consolidates logging into a single file, making analysis easier.

Define which devices will receive this firewall policy by configuring scope tags and assignments. Proper targeting ensures the policy applies only to intended devices.

Click Next to reach the "Scope tags" page. If you use scope tags for role-based administration, select the appropriate tags. For most environments, you can leave this as default and click Next.

On the "Assignments" page:

• Click Add groups under "Included groups"
• Select your target device groups (e.g., "Windows 11 Corporate Devices")
• Click Select

Avoid assigning to "All devices" initially. Start with a pilot group to test the configuration.

Review all configuration settings before creating the policy to ensure everything is configured correctly. Once created, the policy will begin deploying to assigned devices.

Click Next to reach the "Review + create" page. Carefully review:

• Policy name and description
• All three firewall profiles have logging enabled
• Correct device groups are assigned
• Log file paths are properly formatted

If everything looks correct, click Create to deploy the policy.

The policy will appear in your firewall policies list with a status of "Deploying" initially.

Track the deployment progress and verify that target devices are receiving and applying the firewall policy correctly. This step is crucial for ensuring the logging configuration is active.

In the Intune admin center, navigate to Endpoint security > Firewall and click on your newly created policy.

Review the deployment status:

• Device status: Shows how many devices successfully applied the policy
• User status: Shows user-level deployment results
• Click on individual devices to see detailed compliance information

Allow 15-30 minutes for initial deployment to complete. Devices check in with Intune at regular intervals.

Connect to a target device to confirm that the firewall logging settings have been applied correctly and that log files are being generated as expected.

On a target Windows 11 device, open PowerShell as Administrator and run these verification commands:

# Check current firewall logging settings
netsh advfirewall show allprofiles

# Verify specific logging settings
netsh advfirewall show domainprofile logging
netsh advfirewall show privateprofile logging
netsh advfirewall show publicprofile logging

# Check if log file exists and has recent entries
Get-Item "C:\Windows\System32\LogFiles\Firewall\pfirewall.log" -ErrorAction SilentlyContinue
Get-Content "C:\Windows\System32\LogFiles\Firewall\pfirewall.log" -Tail 10

The output should show that logging is enabled for successful connections across all profiles, and the log file should contain recent entries.

Enable Windows Security Event logging for firewall connections to complement the file-based logging. This provides additional forensic capabilities through the Windows Event Log system.

On target devices, run these commands as Administrator to enable audit policies:

# Enable auditing for firewall packet drops and connections
auditpol /set /category:"System" /SubCategory:"Filtering Platform Packet Drop" /success:enable /failure:enable
auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable

# Verify audit settings
auditpol /get /category:"System"

You can also deploy these commands via Intune using a PowerShell script policy for automated configuration across all devices.

After enabling auditing, firewall events will appear in the Security event log with Event IDs like 5152 (connection blocked), 5156 (connection allowed), and 5157 (connection blocked).