# Ensure 'Windows Firewall: Public: Logging: Name' is set to '%SystemRoot%\System32\logfiles\firewall\publicfw.log'

Necessity: Enabling and correctly configuring firewall logging is critical for security monitoring and incident response. The Public profile is used on untrusted networks, making it the most likely to encounter malicious traffic. Logging dropped and successful connections provides a detailed record of network activity, which is essential for detecting intrusion attempts, identifying malware communication, and performing forensic analysis after a security breach. If the log file path is incorrect or points to a non-existent location, this vital security data will be lost, creating a significant visibility gap for security teams.

Auditing and Remediation: The audit script verifies the current configuration by querying the 'LogFileName' property for the Public firewall profile using native PowerShell cmdlets. The remediation script directly modifies this same property, ensuring that logs are written to the specified, standardized location. This allows for consistent log collection and analysis across an enterprise.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is identical because this setting specifies a file path, for which there is a single, well-established best practice. The path '%SystemRoot%\System32\logfiles\firewall\publicfw.log' is the default and standard location for these logs. It resides within a protected system directory, which helps ensure log integrity. Using a non-standard path can complicate log collection for SIEM systems and other monitoring tools. Therefore, the primary security goal is not to vary the path but to ensure it is set to this specific, correct value across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['%SystemRoot%\System32\logfiles\firewall\publicfw.log']` |
| **Moderate** | `['%SystemRoot%\System32\logfiles\firewall\publicfw.log']` |
| **Strict** | `['%SystemRoot%\System32\logfiles\firewall\publicfw.log']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the Windows Defender Firewall log file name for the 'Public' profile. The script must use the 'Get-NetFirewallProfile' cmdlet and output only the string value of the 'LogFileName' property, with no additional text or formatting.

## Remediation Script Working

PowerShell script that sets the Windows Defender Firewall log file name for the 'Public' profile. The script must accept the desired file path as a single, positional command-line argument. It should use the 'Set-NetFirewallProfile' cmdlet to apply the setting and must return '$true' upon successful completion or '$false' if an error occurs.

