What is The Location of Windows 11 Firewall Logs?

First, ensure logging feature is enabled

Reading time icon 5 min. read


Readers help support Windows Report. We may get a commission if you buy through our links. Tooltip Icon

Read our disclosure page to find out how can you help Windows Report sustain the editorial team Read more

Over the years, Windows Firewall has evolved to enhance security and protection against emerging threats and unauthorized access. It also generates logs and provides insights into its activities, and you can monitor & troubleshoot security-related issues with its help.

This guide is for you if you want to learn where Windows Firewall logs are located and interpret them to ensure better security management.

Where can I check Firewall logs on Windows 11?

1. Using the Windows File Explorer

  1. Press Windows + E to open the Windows File Explorer.
  2. Go to the system drive; in our case, it is C.
  3. Now, locate and click on the Windows folder. 
  4. In the Windows folder, go to System32 and click Log Files.Logs - windows 11 firewall logs location
  5. Open the Firewall folder.Firewall
  6. Look for pfirewall.log.Windows Firewall logs - windows 11 firewall logs location

2. Using the Windows Firewall with Advanced Security

  1. Press Windows + R to open the Run window.  wf.msc and click OK - 8 Best Practices for Windows 11 Firewall to Keep Your System Secure
  2. Type wf.msc and click OK to open the Windows Defender Firewall with the Advanced Security window.
  3. Click Monitoring, and on the right pane, locate Logging Settings.Monitoring logging settings
  4. You will see a path with a hyperlink; click it to open the log file location.

How can I interpret the Windows Firewall log?

The Firewall log contains static and descriptive information about the log version and the fields available. Here are some things you can find in the header of the log:

  • Version – Shows the version of the Windows Firewall security log
  • Time – Displays the timestamp information in the log in local time
  • Software – Shows the name of the software creating the log
  • Fields – Displays a list of fields available for security log entries.

Whereas in the body of the log file, you will see

  • Date – In YYYY-MM-DD format
  • Time – In HH:MM:SS format (24 hours format)
  • Action – Information related to the various actions Firewall performs, including logging connection attempts
  • Protocol – Protocol like TCP, UDP, or ICMP
  • SRC-IP – Source IP address
  • dst-ip – Destination IP address
  • src-port – Source port number
  • dst-port – Display port number
  • Size – Packet size in bytes.
  • tcpflags  – Information about TCP flags in TCP headers.
  • tcpsyn – Shows the TCP sequence number
  • tcppack –   Displays the TCP acknowledgment number
  • tcpwin  – TCP window size
  • icmptype – Information about the ICMP messages.
  • info  – Shows an entry that depends on the type of action happened
  • Path (SEND, RECEIVE, FORWARD, or UNKNOWN)- Shows the direction of communication

What if I can’t access the Firewall logs in the default location?

First, reboot your computer and install the latest Windows update to resolve the log generation issues. Also, make sure you have logged in using an administrator account.

1. Check the Firewall settings

  1. Press the Windows key, type windows security in the search box, and click OpenWindows Security open Windows key - windows 11 firewall logs location
  2. Go to Firewall & network protection and click the Advanced settings option to access the Windows Defender Firewall with the Advanced Security window.  Advanced settings
  3. Select Windows Defender Firewall with Advanced Security on Local Computer, and click Properties from the right pane.Properties - Windows 11 Firewall to Keep Your System Secure
  4. Go to the Domain Profile tab or any other active profile (Public or Private), locate Logging, and click Customize.customize - Windows 11 Firewall to Keep Your System Secure
  5. Locate Log dropped packets and ensure Yes is selected from the drop-down menu.Logging Firewall
  6. Look for the Size limit option and increase the log file size.
  7. Click OK, then OK to save the changes.

2. Check file permissions

  1. Press Windows + E to open the File Explorer.
  2. Navigate to C:\Windows\System32\LogFiles\Firewall\pfirewall.logProperties of Firewall log file - windows 11 firewall logs location
  3. Right-click the pfirewall.log and choose Properties from the context menu.     
  4. In the Properties window, go to the Security tab, and you might not see anything but a warning You must have Read permissions to view the properties of this object, so click Advanced.Advanced - windows 11 firewall logs location
  5. On the following window, click Continue.Continue
  6. On the Advanced Security Settings window, locate Owner and click Change.Change - windows 11 firewall logs location
  7. On the Select User or Group window, type the user name of your account or click Advanced.Advanced
  8. Click the Find Now button, select the user from the list, and click OK.Find Now
  9. Click OK on the Select User or Group window. Select the USer and click OK - windows 11 firewall logs location
  10. Click Apply and then OK to save the changes.  Click OK again.Click Apply and OK - windows 11 firewall logs location
  11. However, if you see this page instead, skip steps 5-10, select your username from Group or user names, and click Edit.Edit - windows 11 firewall logs location
  12. In the following dialog box, locate the Permissions field and place a checkmark next to the Read and Write options. You can also select all of them. Click Apply and OK to save the changes.Permissions -
  13. Click Apply and OK again.

Accessing the logs allows you to track network traffic, identify blocked connections, and ensure that your device’s firewall settings are in place.

If you want to know more about the Firewall settings and best practices to follow to keep your computer secure; we have a separate guide for you.

How often do you check the logs of your Windows Firewall on Windows 11? Share your views with our readers in the comments section below.

User forum

0 messages