guidox / Security
Enable logging on the profile with **netsh advfirewall set ... logging**, then read **%systemroot%\system32\LogFiles\Firewall\pfirewall.log** and match the drop against a rule.
Windows Firewall has three profiles and each logs separately. A domain-joined laptop on a home network uses the private profile, not the domain one.
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction
Get-NetConnectionProfile | Select-Object Name,NetworkCategory,InterfaceAlias**LogBlocked** records only drops, which keeps the file small. **MaxFileSize** caps the file and Windows rotates it to .old when it is full.
netsh advfirewall set privateprofile logging maxfilesize=8192 droppedconnections=yes allowedconnections=no
netsh advfirewall set privateprofile logging
Get-NetFirewallProfile -Name Private | Select-Object LogFileName,LogMaxSizeKilobytes,LogBlockedRun the exact app action that fails, then stop. A log with one attempt is readable; a log with an hour of browsing is not.
Remove-Item "$env:systemroot\system32\LogFiles\Firewall\pfirewall.log" -ErrorAction SilentlyContinue
# start the app, try the connection once
Get-Date
Test-NetConnection -ComputerName 192.168.1.50 -Port 445 -InformationLevel DetailedEach line carries a timestamp, the action, the protocol, the local and remote address with port, and the direction. **DROP** with the direction **In** means an inbound rule is missing.
$log = "$env:systemroot\system32\LogFiles\Firewall\pfirewall.log"
Get-Content $log -Tail 30
Select-String -Path $log -Pattern 'DROP' | Select-Object -Last 10 LineThe program name is in the last column. A rule that exists but applies to the wrong profile or the wrong protocol is the most common reason for a drop.
Get-NetFirewallRule -Direction Inbound -Enabled True | Where-Object DisplayName -like '*app*' | Select-Object DisplayName,Profile,Action
Get-NetFirewallApplicationFilter -Program 'C:\Program Files\App\app.exe' | Select-Object Program,InstanceID
Get-NetFirewallRule -DisplayName '*app*' | Get-NetFirewallPortFilter | Select-Object Protocol,LocalPortA rule scoped to the program, the protocol and the remote address is the safe fix. Confirm by repeating the test and checking that the drop no longer appears.
New-NetFirewallRule -DisplayName 'App inbound 445' -Direction Inbound -Program 'C:\Program Files\App\app.exe' -Protocol TCP -LocalPort 445 -RemoteAddress 192.168.1.0/24 -Action Allow -Profile Private
Test-NetConnection -ComputerName 192.168.1.50 -Port 445
Select-String -Path "$env:systemroot\system32\LogFiles\Firewall\pfirewall.log" -Pattern 'DROP' | Select-Object -Last 3 LineLogging is off for the active profile, or the path is blocked by policy. Check Get-NetFirewallProfile for LogFileName and LogBlocked.
The packet never reached the firewall: a router, a switch ACL or the app itself is the cause. Test the port with Test-NetConnection from another host.
A block rule wins over an allow rule. Sort by Action and check for a block rule on the same port or program.
Turn allowed connections off and keep only dropped ones. The max size caps the file, but a busy network still fills it quickly.
It is a diagnostic aid. For real monitoring, forward the events to a collector; the Security log with auditing is the audited path.
Each profile has its own log file setting, so a machine that switches networks can write to two different files.
Detectably only under heavy drop rates. For normal use the cost is negligible.
Turn logging off with netsh advfirewall set privateprofile logging droppedconnections=no, delete the rule with Remove-NetFirewallRule -DisplayName 'App inbound 445', and remove the log file if you do not need it.
Free · no account needed · tracks your progress