# Ensure 'Windows Firewall: Private: Logging: Name' is set to '%SystemRoot%\System32\logfiles\firewall\privatefw.log'

Necessity: Enabling and properly configuring firewall logging is critical for security monitoring and incident response. The log file for the Private network profile records allowed and dropped connections on trusted networks (e.g., home or corporate). This data is essential for detecting unauthorized access attempts, identifying potential malware communication, and performing forensic analysis after a security incident. Misconfiguration, such as disabling logging or directing logs to a non-standard location, can create significant blind spots for security teams.

Auditing and Remediation: The audit script verifies the configured path for the private firewall log by querying the specific registry key where this setting is stored. The remediation script ensures that logging is directed to the correct, standardized location by setting this registry value to the recommended path. This ensures that log collection agents and security information and event management (SIEM) systems can reliably find and ingest the firewall data.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is '%SystemRoot%\System32\logfiles\firewall\privatefw.log'. This is the standard, default location expected by system administrators and security tools. Using a non-standard path can complicate log management and may cause automated collection tools to fail. Therefore, adherence to this specific path is considered a universal best practice, providing a consistent and reliable source for security event data without variation between different hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['%SystemRoot%\System32\logfiles\firewall\privatefw.log']` |
| **Moderate** | `['%SystemRoot%\System32\logfiles\firewall\privatefw.log']` |
| **Strict** | `['%SystemRoot%\System32\logfiles\firewall\privatefw.log']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value at 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging\LogFilePath'. The script must expand the environment variable in the path and return only the resulting string value. If the value does not exist, the script should return an empty string.

## Remediation Script Working

PowerShell script that accepts one positional string argument representing the desired log file path. The script must set the 'LogFilePath' registry value (as REG_EXPAND_SZ type) at 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging' to the value provided in the argument. The script must create the key if it does not exist. It must return $true on success and $false on failure.

