Windows Server 2008 and Firewall Logging

Question

Our Windows server 2008 R2 domain controller does not appear to be logging anything into the windows firewall log: c:\windows\system32\logfiles\firewall\pfirewall.log.  The file is always blank.  Every 2003 server and 2008 R2 non-dc work fine. 
I'm a little stumped.  The firewalls are configured via GPO's and appear to be applied ok. 
I compared the 2003 and 2008 configuration and did notice one discrepancy:
The 2003 windows firewall service runs as the local system account.  It's effective permissions to the pfirewall.log file is "full control"
However, the 2008 firewall service runs as "LOCAL SERVICE".  This account has read-only permissions to the pfirewall.log file. 
I haven't changed anything as this is a production server.  I was hoping for some guidance before I start changing default settings.  Any ideas why the pfirewall.log file is always blank?
Thanks!

Answer 1

Hi,
Generally, C:\Windows\System32\LogFiles\Firewall\firewall.log has the following permission settings:
NT SERVICE\MpsSvc:(F)
NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
BUILTIN\Network Configuration Operators:(F)
Please make sure MPSSvc (Windows Firewall service) has Full Control on this file.
Thanks.
This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question.
This can be beneficial to other community members reading the thread.
This worked for me on a 2008 R2 DC that had somehow dropped the MpsSvc account off the Permissions list. In my case the pfirewall.log file wasn't even being created, so I had to modify permissions for the "%systemroot%\System32\LogFiles\Firewall"
folder.
Adding the MpsSvc account can be tricky if you're not familiar with where to look. Here are some supplemental instructions that might prove useful to those like myself who might not do this type of thing every day. Remember that these instructions for for
a 2008 R2 Domain Controller.
Open the "%systemroot%\System32\LogFiles\Firewall" folder. If necessary, "Click Continue to permanently get access to this folder."
Right-click the empty space in the Firewall folder and click Properties.
Go to the Security tab and click the Edit button.
In the "Permissions for Firewall" window, click the Add
button. The next step is where it gets tricky.
Click the Object Types button and in the window that opens, make sure the
Service Accounts box is checked. Click OK.
Now click the Locations button. In the window that opens, make sure you change the default selection from the domain name to your Domain Controller's hostname (e.g. DC01).
Click OK.
In the object names text field, type "NT SERVICE\MpsSvc". If you were to simply enter "MpsSvc" it wouldn't work. This is not case sensitive, but the context of your entry is very specific.
Click Check Names and your entry should automatically change to an underlined "MpsSvc" value.
Click OK.
Back on the "Permissions for Firewall" window, you can give MpsSvc
Full Control of the Firewall folder, then click OK.
You'll see a warning about changing permission settings on system folders. Read it, and if you accept the risk, click
Yes. (Otherwise click No and enjoy your non-existent firewall logs.)
Click OK again to save your changes and close the
Firewall Properties window.
You may have to restart the Windows Firewall service before the firewall log file will appear.
You should also run a "gpupdate" just to make sure your settings are permanent and aren't being overridden by a GPO somewhere out there in Active Directory.
That's all folks!
"This posting is provided "AS IS" with no warranties, and confers no rights."
-Mike