Enabling Windows Firewall logging only without enabling the profiles?

Question

I'm looking for information on the ports and protocols that the Windows server currently uses as a baseline before enabling the Windows Firewall profiles.

I aim to enable the built-in firewall on each of my Production Windows Servers without causing a major outage. Is it possible to allow just logging without enabling the Windows Server Firewall?

https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/configure-logging?tabs=gpo#recommendations

Any help would be greatly appreciated.

Answer 1

Hi,

You can try,

• Enable Logging for All Profiles https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/configure-logging
  • netsh advfirewall set allprofiles logging allowedconnections enable
  • netsh advfirewall set allprofiles logging droppedconnections enable
• Enable Audit Logging
  • Auditpol /set /category:"System" /SubCategory:"Filtering Platform Packet Drop" /success:enable /failure:enable
  • Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable

|-------------------------------->>> If the reply was helpful please don't forget to upvote and/or accept as answer, thank you