# Ensure 'Windows Firewall: Public: Logging: Log dropped packets' is set to 'Yes'

Necessity: Logging dropped packets is a critical security function for identifying malicious activity. The Public profile is used in untrusted networks (e.g., public Wi-Fi), where the risk of attack is highest. These logs provide a record of unauthorized connection attempts, network scans, and other hostile actions that the firewall has blocked. Without these logs, administrators have no visibility into the threats targeting the system, severely hampering incident response and forensic analysis. Failing to log dropped packets creates a significant security blind spot.

Auditing and Remediation: The audit script verifies the current state of the 'LogDroppedPackets' setting for the firewall's Public profile. The remediation script directly modifies this setting, enabling or disabling the logging of dropped packets as specified by the input parameter.

Recommended State Rationale: 
Basic: ['Yes']. This is the minimum acceptable security posture. Logging dropped packets provides essential data for security monitoring on any system connected to an untrusted network.
Moderate: ['Yes']. As there is no intermediate setting, enabling logging remains the standard recommendation for a moderately hardened system. The value of the logs for security analysis is non-negotiable.
Strict: ['Yes']. In a high-security environment, comprehensive logging is mandatory for compliance, threat hunting, and detailed incident forensics. Therefore, enabling this feature is the only appropriate configuration for a strictly hardened system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Yes']` |
| **Moderate** | `['Yes']` |
| **Strict** | `['Yes']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the 'Public' profile of the Windows Defender Firewall. The script must use the 'Get-NetFirewallProfile' cmdlet to retrieve the value of the 'LogDroppedPackets' property. The script must only output the resulting boolean value ('True' or 'False') and nothing else.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which will be either 'Yes' or 'No'. The script must use the 'Set-NetFirewallProfile' cmdlet to configure the 'LogDroppedPackets' property for the 'Public' profile to match the input value ('Yes' corresponding to '$true', 'No' to '$false'). The script must return '$true' upon successful modification or '$false' if it fails.

