Where does Windows Defender Firewall store its log files on Windows?

Windows Defender Firewall

1 log location · Windows

Microsoft Corporation · Vendor documentation

Where Windows Defender Firewall keeps its logs

Windows Defender Firewall logs to %WINDIR%\System32\LogFiles\Firewall\pfirewall.log on Windows.

Paths are printed exactly as Windows Defender Firewall writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.

Finding your way around Windows.

WIN

Windows Defender Firewall - Windows

Microsoft Corporation

Dropped packets and connections

%WINDIR%\System32\LogFiles\Firewall\pfirewall.log- Off by default; enable per profile with Group Policy, Intune or netsh.

Wrong path? Add a variant