Change the Name and Location of the Windows Firewall Log File

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Use this procedure when you want to change the name and location of the Windows Firewall log file. This is useful if you do not want users to easily find the log file or you want to have the log file written to a central location.

Administrative Credentials

To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure.

Special Considerations

You can configure Windows Firewall settings in the standard profile or the domain profile. The domain profile is used when a computer is connected to a network in which the computer's domain account resides. The standard profile is used when a computer is connected to a network in which the computer's domain account does not reside, such as a public network or the Internet. Make sure Windows Firewall is using the correct profile when you perform this procedure.

For more information about Windows Firewall profiles, see Managing Windows Firewall Profiles.

To change the name and location of the Windows Firewall log

This procedure can be performed using the graphical user interface or the command prompt.

Using the graphical user interface

To change the name and location of the Windows Firewall log

  1. Open Windows Firewall, and click the Advanced tab.

  2. In Security Logging, click Settings.

  3. Click Save As, and navigate to the location where you want to save the log file.

  4. In File name, type the new log file name, or leave it blank to accept the default name of pfirewall.log.

  5. Click Save, and then click OK.

If a Windows Firewall setting appears dimmed in the graphical user interface, and on the General tab, you see For your security, some settings are controlled by Group Policy, the setting might be managed by Group Policy. If all Windows Firewall settings appear dimmed, and on the General tab, you see You must be a computer administrator to change these settings, you do not have administrative rights to configure Windows Firewall.

Using the command prompt

To change the name and location of the Windows Firewall log

  • Type the following at the command prompt, and press ENTER:

    netsh firewall set logging filelocation = "filelocation"

Substitute values for the placeholders in italics. The following table lists possible values for each placeholder.

Placeholder Possible Values Description

filelocation

Any string that includes a valid path and file name for a text file.

You must enclose filelocation in quotation marks if there are spaces in the path or file name.

If you get an "Access Denied" message when you run a command, you do not have administrative rights to configure Windows Firewall. If you get an "Ok" message but the command does not take effect, the setting might be managed by Group Policy.

Notes

  • To start Windows Firewall, click Start, point to Control Panel, and then click Windows Firewall.

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command Prompt.

  • Windows Firewall is not included in the original release of the Windows Server 2003 operating systems.

See Also

Concepts

Known Issues for Using the Windows Firewall Log
Enable or Disable the Windows Firewall Log
View the Windows Firewall Log File
Change the Size of the Windows Firewall Log File