# Ensure 'Windows Firewall: Public: Logging: Log dropped packets' is set to 'Yes'

Necessity: Enabling the logging of dropped packets is critical for security monitoring and incident response. It provides a detailed record of all inbound traffic that the firewall has blocked. This log is invaluable for identifying reconnaissance activities, such as port scans, and detecting connection attempts from unauthorized or malicious sources. Without this log, an organization has a significant blind spot, making it difficult to analyze attack patterns or troubleshoot network connectivity issues related to firewall rules.

Auditing and Remediation: The audit script checks the current configuration of the 'LogDroppedPackets' property for the public firewall profile. The remediation script directly modifies this setting using the 'Set-NetFirewallProfile' cmdlet, enabling or disabling the feature based on the provided argument.

Recommended State Rationale: 
- Basic: ['Yes']. This is the minimum recommended state. Logging dropped packets provides essential visibility into potential threats that are being actively blocked, which is a foundational security practice.
- Moderate: ['Yes']. For this binary setting, there is no effective intermediate state. The security benefits of logging are fundamental, thus the moderate recommendation is the same as the basic one.
- Strict: ['Yes']. In a highly secure environment, complete and comprehensive logging is non-negotiable. Enabling this feature ensures that all potentially hostile network activity denied by the firewall is recorded for forensic analysis, which is a requirement for strict security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Yes']` |
| **Moderate** | `['Yes']` |
| **Strict** | `['Yes']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the 'LogDroppedPackets' setting for the 'Public' network profile using the 'Get-NetFirewallProfile' cmdlet. The script should map the resulting boolean value to a string, outputting 'Yes' if the value is 'True' and 'No' if it is 'False'. The script must return only the current state ('Yes' or 'No') without any additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('Yes' or 'No') to configure the 'Windows Firewall: Public: Logging: Log dropped packets' setting. The script must use the 'Set-NetFirewallProfile' cmdlet for the 'Public' profile. If the input is 'Yes', it must set the '-LogDroppedPackets' parameter to '$true'; if 'No', it must set it to '$false'. The script must return '$true' upon successful execution and '$false' if an error occurs.

