# Ensure 'Windows Firewall: Private: Logging: Log dropped packets' is set to 'Yes'

Necessity: Enabling the logging of dropped packets is critical for security monitoring and incident response. It provides a detailed record of all inbound traffic that the firewall has blocked. This log is invaluable for identifying unauthorized connection attempts, detecting network reconnaissance like port scans, and providing forensic evidence in the event of a security breach. Without this logging, an organization has a significant blind spot, making it much harder to detect, investigate, and respond to network-based attacks. Misconfiguration (leaving it disabled) significantly hampers an organization's defensive and investigative capabilities.

Auditing and Remediation: The audit script checks the current configuration of the 'LogDroppedPackets' property for the Private firewall profile using the 'Get-NetFirewallProfile' PowerShell cmdlet. The remediation script uses the 'Set-NetFirewallProfile' cmdlet to modify this same property, enabling or disabling the logging of dropped packets based on the provided argument.

Recommended State Rationale: 
Basic: ['Yes']. This is the minimum acceptable state for any security-conscious environment. Enabling logging is a foundational step in network security visibility, aligning with CIS benchmarks and general best practices.
Moderate: ['Yes']. For this binary setting, there is no effective intermediate state. Maintaining a moderate security posture requires the visibility that logging provides. The value remains 'Yes' as it is essential for active security monitoring.
Strict: ['Yes']. In a high-security environment, comprehensive logging is non-negotiable. This setting provides crucial data that can be ingested by Security Information and Event Management (SIEM) systems for real-time analysis and alerting. It represents the most secure configuration for this control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Yes']` |
| **Moderate** | `['Yes']` |
| **Strict** | `['Yes']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'LogDroppedPackets' setting for the 'Private' profile of the Windows Defender Firewall. The script must translate the boolean output ($true/$false) to the string 'Yes' or 'No' and return only this string value.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('Yes' or 'No'). The script will configure the 'LogDroppedPackets' setting for the 'Private' profile of the Windows Defender Firewall by translating the input string to its corresponding boolean value ($true for 'Yes', $false for 'No'). The script must return $true on success and $false on failure.

