# Ensure 'Windows Firewall: Public: Logging: Log successful connections' is set to 'Yes'

Necessity: Logging successful connections is critical for security monitoring and incident response. It provides a detailed audit trail of all network traffic that is permitted through the firewall. This log is invaluable for identifying unauthorized access, detecting anomalous network patterns, and conducting forensic analysis after a security breach. Without this logging, an organization has a significant blind spot, making it difficult to trace the actions of an attacker or understand the scope of a compromise, especially on public networks which are inherently untrusted.

Auditing and Remediation: The audit script checks the boolean value of the 'LogAllowed' property for the 'Public' profile using the 'Get-NetFirewallProfile' cmdlet. The remediation script uses the 'Set-NetFirewallProfile' cmdlet to modify this same property, enabling or disabling the logging of successful connections based on the provided input.

Recommended State Rationale:
- Basic: ['True']. Enabling logging is the minimum requirement for maintaining a basic level of network visibility and accountability. This state ensures that a fundamental audit trail is being created.
- Moderate: ['True']. For a moderate security posture, comprehensive logging is not optional. The value remains 'True' as there is no less secure, yet acceptable, alternative.
- Strict: ['True']. In a high-security environment, complete visibility into all network traffic is paramount. Disabling logging for any reason is unacceptable. Therefore, the strictest configuration mandates that logging for successful connections is always enabled to support continuous monitoring and rapid incident response.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['True']` |
| **Moderate** | `['True']` |
| **Strict** | `['True']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the current state of the 'Log successful connections' setting for the Windows Firewall Public Profile. The script should use the 'Get-NetFirewallProfile' cmdlet, filter for the profile named 'Public', and output only the value of the 'LogAllowed' property (e.g., 'True' or 'False').

## Remediation Script Working

PowerShell script that configures the 'Log successful connections' setting for the Windows Firewall Public Profile. The script must accept a single command-line argument which must be either 'True' or 'False'. It should use the 'Set-NetFirewallProfile' cmdlet to apply the setting to the 'Public' profile via the '-LogAllowed' parameter. The script must return '$true' upon successful execution and '$false' if it fails.

