# Ensure 'Windows Firewall: Public: Logging: Log successful connections' is set to 'Yes'

Necessity: Enabling the logging of successful connections for the Windows Defender Firewall's Public profile is crucial for security monitoring and incident response. This log provides a detailed audit trail of all permitted network traffic, which is essential for identifying anomalous behavior, detecting potential security breaches, and conducting forensic analysis. Without this logging, administrators have a significant blind spot, as they cannot see what traffic is successfully passing through the firewall, making it difficult to trace unauthorized data access or exfiltration.

Auditing and Remediation: The audit script verifies the current configuration by checking the 'LogAllowed' boolean property of the 'Public' firewall profile using the Get-NetFirewallProfile cmdlet. The remediation script uses the Set-NetFirewallProfile cmdlet to change this same 'LogAllowed' property to either true ('Yes') or false ('No'), based on the provided input argument.

Recommended State Rationale: The recommendation for all security levels (Basic, Moderate, and Strict) is 'Yes'. This is because network visibility is a foundational security requirement, not a tiered option. Basic security requires this log to meet compliance and establish a baseline for monitoring. For Moderate and Strict levels, this logging is non-negotiable and forms the basis for more advanced threat detection and analysis systems. There is no secure state in which logging successful connections is disabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Yes']` |
| **Moderate** | `['Yes']` |
| **Strict** | `['Yes']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the 'Log successful connections' setting for the Windows Defender Firewall's Public profile. The script must use the Get-NetFirewallProfile cmdlet for the 'Public' profile and inspect the 'LogAllowed' property. The script's output must be solely the boolean value ($true or $false) representing the current state.

## Remediation Script Working

PowerShell script that sets the 'Log successful connections' configuration for the Windows Defender Firewall's Public profile. The script must accept a single positional command-line argument: 'Yes' or 'No'. It will use the Set-NetFirewallProfile cmdlet to modify the 'LogAllowed' property for the 'Public' profile based on the input. The script must return $true on success and $false on failure.

