Windows Firewall: Private: Logging: Log successful connections
A `REG_DWORD` value of `1` enables logging for connections allowed by Windows Firewall under the private network profile.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging\LogSuccessfulConnections
A REG_DWORD value of 1 enables logging for connections allowed by Windows Firewall under the private network profile. Windows records these as ALLOW entries in the firewall log file used by that profile.
This setting records allowed traffic. It does not modify firewall rules or influence whether a connection is allowed or blocked.
Notes
Security
The resulting records provide visibility into connections permitted by the firewall. They can support security analysis, intrusion detection, and investigation of unexpected network communication. Logging does not prevent attacks and is not a substitute for restrictive firewall rules or other monitoring controls.
Possible side effects
Successful connections can fill the log quickly. When the configured maximum file size is reached, Windows removes older entries to make room for new ones. More frequent log rotation can also increase resource usage.
Notes
The value applies only to the private firewall profile. The domain and public profiles have separate settings. It does not enable Windows Firewall, activate the private profile, or define the log file path or maximum size.
The Windows Firewall service, mpssvc, must have write access to the log location. If the directory is absent or the required permissions are unavailable, entries might not be written even though this value is enabled.
Microsoft documentation is not fully consistent about direction. The Group Policy logging documentation explicitly describes allowed inbound connections, while the documentation for the corresponding per-profile LogAllowed property states that both incoming and outgoing connections allowed by policy are logged.
Microsoft documentation
Microsoft Learn: Configure Windows Firewall logging
Microsoft Learn: Reference — Azure Policy guest configuration baseline for Windows