Key Takeways:
- Logg successful connections in Windows Defender Firewall
- Helps admins track allowed traffic, not just blocked attempts
- Easier to detect anomalies, validate compliance, and support forensic investigations
- Auditing allowed traffic for sensitive applications
Let’s discuss Enable Log Success Connections in Windows Defender Firewall using Intune. Admins can use this policy to to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word ALLOW in the action column of the log.
Table of Contents
Table of Contents
Enable Log Success Connections in Windows Defender Firewall using Intune
Many regulatory frameworks (like HIPAA, PCI-DSS, or SOC2) require organizations to maintain a record of all network traffic, not just the blocked attempts. It proves that “User A” actually connected to “Server B” at a specific time.
- 4 New Intune Windows Firewall Logging Configuration Policies
- Ways to Allow an App through Windows Defender Firewall
- Check Firewall Policy Reports from Intune
Example Scenario
Imagine a rogue employee is slowly copying sensitive files from a corporate file server to their local machine over several months. Since the employee has legitimate access, the firewall allows the connection. If “Log Success” is Disabled, there is no firewall record of this ever happening. If Enabled, security analysts can see a pattern of unusual, high-volume successful connections at 2:00 AM, triggering an alert.
How to Start Policy Creation
As an Admin, you can quickly configure this policy on your organisation. To start the Policy Creation, open the Microsoft Intune Admin center. Then go to Devices > Configuration >+ Create > +New Policy.
Profile Creation
Profile creation is the necessary step that helps you to assign the policy to appropriate platform and Profile. Here I would like to configure the policy to Windows 10 and later platform and settings catalog profile. Then click on the Create button.
Adding the Basic Details
Naming the policy is the primary step that help admins to identify the policy later. This is important and necessary step that allows you to know the purpose of the policy. Here is Name is mandatory and description is optional. After adding this click on the Next button.
Configure Block Office Applications from Creating Executable Content
With Settings Picker, you can use the Configuration Settings Tab. On this tab, you can click on the +Add Settings hyperlink to get the Settings Picker. The settings picker shows huge number of settings. Here, I would like to select the settings by browsing by Category. I choose Defender\Block Office applications from creating executable content.
Disable Log Success Connections
When you set this to Disabled, you are telling the firewall to perform “Default Logging” only. In this state, the firewall is still active, but it ignores “Allowed” traffic.
Enable Log Success Connections
When you set this to Enabled, you are instructing the Windows Defender Firewall service to record an event in the local firewall log (pfirewall.log) every time a network packet passes through the firewall without being dropped.
Scope Tags
With scope tags, you create a restriction to the visibility of theEnable Log Success Connections in Windows Defender Firewall. It helps to organise resources as well. Here, I would like to skip this section, because it is not mandatory. Click on the Next button.
Assignments Tab for Selecting Group
To assign the policy to specific groups, you can use the Assignment Tab. Here I click, +Add groups option under Included groups. I choose a group from the list of groups and click on the Select button. Again, I click on the Select button to continue.
Review + Create Tab
Before completing the policy creation, you can review each tab to avoid misconfiguration or policy failure. After verifying all the details, click on the Create Button. After creating the policy, you will get a success message.
Monitoring Status
The Monitoring Status page shows whether the policy has succeeded or not. To quickly configure the policy and take advantage of the policy sync the assigned device on Company Portal. Open the Intune Portal. Go to Devices > Configuration > Search for the Policy. Here, the policy shows as successful.
Event Viewer Details
Event Viewer helps you check the client side and verify the policy status. Open the Client device and open the Event Viewer. Go to Start > Event Viewer. Navigate to Logs: In the left pane, go to Application and Services Logs > Microsoft > Windows > Windows Defender > Operational.
| Event viewer Details |
|---|
| Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration \ToastOrSsoTrigger= 0x1 New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration \ToastOrSsoTrigger = 0x0 |
Removing the Assigned Group from How to Block Log Success Connections in Windows Defender Firewall
If you want to remove the Assigned group from the policy, it is possible from the Intune Portal. To do this, open the Policy on Intune Portal and edit the Assignments tab and the Remove Policy.
To get more detailed information, you can refer to our previous post – Learn How to Delete or Remove App Assignment from Intune using by Step-by-Step Guide.
How to Delete How to Delete Log Success Connections in Windows Defender Firewall
You can easily delete the Policy from the Intune Portal. From the Configuration section, you can delete the policy. It will completely remove it from the client devices.
For detailed information, you can refer to our previous post – How to Delete Allow Clipboard History Policy in Intune Step by Step Guide.
Need Further Assistance or Have Technical Questions?
Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community and the WhatsApp channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.
Author
Anoop C Nair is a Workplace Technology solution architect with 25+ years of experience. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He is a blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, and Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Entra, and Microsoft Security.