Windows Firewall: Private: Logging: Log dropped packets
This registry value controls logging for incoming network packets that Windows Defender Firewall drops under the private firewall profile.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging\LogDroppedPackets
This registry value controls logging for incoming network packets that Windows Defender Firewall drops under the private firewall profile. A DWORD value of 1 enables this logging.
The setting does not modify firewall rules or influence whether a packet is allowed or dropped. It only records drop decisions already made by the firewall in the firewall log file. Successful connections are not logged by this value.
Notes
Security
The resulting entries can help investigate blocked communication attempts, incorrectly defined firewall rules, and suspicious inbound network traffic. The setting grants no additional access and does not weaken firewall filtering.
Possible side effects
A high volume of dropped packets can cause the firewall log to fill more quickly. When the configured maximum size is reached, Windows removes older entries to make room for new ones. More frequent log rotation can also increase resource usage.
Notes
The value applies only to traffic processed under the private firewall profile. Logging for the domain and public profiles is controlled by separate values.
Entries can be written only when Windows Defender Firewall is active and the firewall service has write access to the configured log location. Other settings determine the log path and maximum file size.
Microsoft documentation
Microsoft Learn: Configure Windows Firewall logging
Microsoft Learn: Log Dropped Packets registry value