# Ensure 'Windows Firewall: Public: Logging: Name' is set to '%SystemRoot%\System32\logfiles\firewall\publicfw.log'

The Public profile for the Windows Defender Firewall is used on untrusted networks like public Wi-Fi hotspots. Logging firewall activity for this profile is critical for security monitoring and incident response. These logs record both dropped packets and successful connections, providing an essential audit trail for identifying potential attacks, unauthorized access attempts, or malware communications. Failure to configure a proper logging location can leave administrators blind to malicious activity on the most vulnerable network connections. The audit script verifies the configured log file path for the Public profile. The remediation script sets this path to the specified value. The recommended state for all hardening levels is '%SystemRoot%\System32\logfiles\firewall\publicfw.log', which is the default and standard location. Using a consistent, system-managed location ensures that security tools and administrators can reliably locate and parse firewall logs for analysis. There is no security advantage to be gained by changing this path, so the recommendation is uniform across all levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['%SystemRoot%\System32\logfiles\firewall\publicfw.log']` |
| **Moderate** | `['%SystemRoot%\System32\logfiles\firewall\publicfw.log']` |
| **Strict** | `['%SystemRoot%\System32\logfiles\firewall\publicfw.log']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'LogFileName' property for the 'Public' network profile from the Windows Defender Firewall configuration. The script must only return the current string value of the log file path, with no additional text or formatting.

## Remediation Script Working

PowerShell script that sets the 'LogFileName' property for the 'Public' network profile in the Windows Defender Firewall configuration. The script must accept the desired log file path as a single, positional command-line argument. The script must return the boolean value '$true' upon successful configuration and '$false' if it fails.

