Windows Firewall: Public: Logging: Log successful connections
This registry value controls the logging of network connections allowed by Windows Firewall while the public network profile is in use.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging\LogSuccessfulConnections
This registry value controls the logging of network connections allowed by Windows Firewall while the public network profile is in use. It is a REG_DWORD value; a value of 1 enables successful-connection logging.
Windows Firewall records captured connections in its firewall log with the action ALLOW. Entries contain connection metadata such as the time, protocol, source and destination addresses, and source and destination ports. This setting does not modify firewall rules or affect whether a connection is allowed or blocked.
Microsoft's current Group Policy documentation describes the setting as logging allowed inbound connections. The netsh advfirewall reference describes the underlying allowedconnections option more broadly as recording successful inbound and outbound connections.
Notes
Additional effects
The additional records support network troubleshooting and analysis of permitted traffic. They can show when a connection was allowed and identify the endpoints and ports involved.
Security
Successful-connection logging improves the visibility and auditability of permitted network activity, but it does not provide additional traffic protection or block connections.
Because the log can contain IP addresses, ports, protocols, and connection times, it can reveal information about the computer's services and communication relationships if unauthorized parties obtain access to the file.
Possible side effects
Logging successful connections can produce substantially more records than logging dropped packets alone. The firewall log can therefore reach its configured size limit more quickly. When that limit is reached, Windows removes older entries to make room for new records.
Notes
The value belongs specifically to the public firewall profile and therefore applies to network connections for which that profile is active. Windows Firewall must be enabled, and its service must have permission to write to the configured log location. Separate settings determine the log file path and maximum file size.
Microsoft documentation
Microsoft Learn: Configure Windows Firewall logging
Microsoft Learn: Windows security baseline reference