How to activate FW logs

Occasional Contributor

Hello,

Was is the best way to activate Windows FW logs with a MEM policy (with all the usual settings available with the related GPO) ?

I tried to find any setting/template which can be used by a configuration profile but I haven't find any yet.

I tried to import GPOs but it seems they are 'deprecated' for MDM (cf. screenshot below).

2022-09-14 15_17_30-Firewall logs - Microsoft Endpoint Manager admin center.png

Regards

 

 

 

3 Replies

@semangard-post 

 

At this blade you can create a Windows Firewall policy which can audit connections by generating events:

 

https://endpoint.microsoft.com/#view/Microsoft_Intune_Workflows/SecurityManagementMenu/~/firewall 

 

Reference: Policy CSP - Audit 

WinFW-Audit.png

Please like or mark this thread as answered if it's helpful, thanks!

 

Thanks @Kurt Mayer 

Sure but how to get all the usual settings available with similar GPO, for ex the path of the logs ?

@semangard-post 

 

It seems there isn't a GPO or configuration profile for it. Next best bet may be to just enable it with a PowerShell script, like this:

 

Simple Network Monitoring With Windows Firewall Logging And Reporting 

How to Deploy PowerShell Script using Intune (MEM) 

 

Please like or mark this thread as answered if it's helpful, thanks!