2

We are having a strange issue with Windows Firewall setting.

The logging file path cannot be set. After I have enabled the Logging setting and click on OK to save the setting. When I open up logging settings again, the logging file path check box is set back to "Not Configured".

I have ensured the Firewall folder has the correct permission (Modify permission) for the firewall service but I am still seeing this strange behavior.

Any idea what is causing this issue?

minisch
  • 63
  • 3
  • 8

1 Answers1

2

Tried this in my environment with similar results. Taking a look at this TechNet discussion, it appears that option doesn't actually map to a real setting. The correct key to enable logging appears to be:

Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile > Windows Firewall: Allow logging

While this is odd, I believe I can offer an explanation for this behavior. Microsoft simply duplicated the Windows firewall GUI for use in the Group Policy editor. Most of the settings in the new (Vista+) version of Windows firewall are new additions, with a few exceptions, logging being one of them. Logging was an option in XP SP2, as show by the compatibility list on that policy:

Windows Firewall: Allow logging -> Supported on: At least Windows XP Professional with SP2

Most likely, Microsoft just didn't want to break the forward compatibility on this existing setting, and instead, just disabled the corresponding checkbox in the newer GUI configuration. You may still need to configure the other options aside from the logging locations in order for logging to function properly.

tfrederick74656
  • 1,452
  • 1
  • 13
  • 29
  • Hi I checked the group policy, the setting "Windows Firewall: Allow logging" is already enabled with default path. However, I do not see the firewall log generated in the default folder. Do you know why? – minisch Dec 10 '15 at 23:06
  • You still have to set the `Log dropped packets` and/or `Log successful connections` on the first Windows firewall settings page in Group Policy. Otherwise, logging is enabled, but there's nothing configured to actually log. – tfrederick74656 Dec 11 '15 at 03:07
  • Yes, I did that. Its weird. I build another two new ADs, they are all having the same issue....... – minisch Dec 11 '15 at 04:33