Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. LogFiles
  5. Firewall
FolderRisk: Caution

Firewall C:\Windows\System32\LogFiles\Firewall

Folder of the Windows Firewall log (pfirewall.log), created when firewall logging is enabled.

Updated on By AltF4 Formation

What it’s for

%windir%\System32\LogFiles\Firewall is the default location of the Windows Firewall log. It receives pfirewall.log, with dropped packets and successful connections, according to what each profile (Domain, Private, Public) logs.

What it contains

  • pfirewall.log, the current log, if logging is enabled.
  • pfirewall.log.old, the copy of the previous log: Windows renames the file when it reaches its maximum size, then starts a new one.
  • Nothing at all, or not even the folder, as long as logging was never turned on.

Risks and best practices

  • The path is set per profile, so check the configuration before looking for the file.
  • A custom destination folder must stay writable by the firewall service, or logging stops.
  • Delete or archive the log file, not the folder.

Useful commands

Fenêtre de terminal
# Where each profile writes its log, and what it records there
Get-NetFirewallProfile | Select-Object Name, LogFileName, LogAllowed, LogBlocked, LogMaxSizeKilobytes


# Folder contents
Get-ChildItem "$env:windir\System32\LogFiles\Firewall" -Force

Folder contents

Logs 1

Report a mistake