In modern enterprise environments, network visibility plays a critical role in maintaining security, supporting troubleshooting, and protecting systems across distributed infrastructures.
Technologies such as Windows Defender Firewall are widely used to control inbound and outbound traffic, acting as a first line of defense against unauthorized network access.
However, while firewalls are effective at blocking unwanted traffic, many organizations overlook the importance of understanding what is being denied.
When dropped traffic is not logged, administrators lose valuable insight into potential threats, misconfigurations, and suspicious connection attempts.
One important security capability designed to address this gap is Firewall Dropped Packet Logging.
Windows Firewall can be configured to record all dropped packets, allowing administrators to analyze denied traffic and gain visibility into network activity that would otherwise remain hidden.
If this logging is not enabled, critical indicators such as scanning attempts, unauthorized connections, or application misbehavior may go unnoticed.
Microsoft provides a policy that allows organizations to enable dropped packet logging across managed devices, ensuring that denied traffic is consistently recorded and available for analysis.
By enforcing this configuration through Microsoft Intune, administrators can ensure that all managed endpoints generate firewall logs, supporting both security monitoring and operational troubleshooting.
When enabled, this policy enhances visibility into blocked network traffic, helping organizations detect anomalies, investigate incidents, and strengthen their overall security posture.
The result is a more transparent and controlled network environment, where denied traffic is no longer invisible but becomes a valuable source of security intelligence.
Why This Policy Matters
Network traffic control is essential in modern IT environments, but without visibility, even strong security controls can become limited in effectiveness.
Firewalls enforce rules, but without logging, they operate without insight into what is being blocked.
Without enabling dropped packet logging:
Blocked traffic is not visible to administrators
Suspicious connection attempts may go undetected
Troubleshooting network issues becomes more complex
Security investigations lack important forensic data
By enabling dropped packet logging:
Administrators gain visibility into denied connections
Suspicious activity such as port scanning can be identified
Network troubleshooting becomes more efficient
Security monitoring and detection capabilities are significantly improved
This configuration aligns with modern security principles such as visibility, endpoint hardening, proactive monitoring, and Zero Trust architecture.
Windows Firewall CSP Overview
This section explains how the policy is exposed at the operating system level and how Microsoft Intune interacts with it.
The configuration of Windows Firewall settings through Intune is powered by the Windows Policy Configuration Service Provider (CSP) framework.
Within this framework, the Firewall CSP enables administrators to manage firewall behavior directly at the OS level, including profile configuration, traffic control, and logging capabilities.
The specific setting responsible for enabling dropped packet logging is:
./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableLogDroppedPackets
This setting acts as a switch that determines whether Windows Firewall logs dropped network packets for the selected profile.
This configuration:
Applies at the device scope
Is supported on modern Windows editions such as Pro, Enterprise, Education, and IoT Enterprise
Requires Windows 11 version 22H2 and later
Is enforced through the Windows MDM engine when deployed via Intune
When this value is enabled:
Windows Firewall logs all dropped packets
Blocked network traffic becomes visible
Administrators gain insight into denied connections and potential threats
Additionally, this setting follows a “merge behavior”, where enabled values take precedence when multiple policies are applied.
Description Framework Properties
This section defines how the configuration behaves at a technical level within the CSP framework.
Understanding these properties is essential for ensuring correct deployment and avoiding configuration conflicts.
Key configuration properties include:
Format: bool
Access Type: Get, Replace
Default Value: false
This means:
The setting is disabled by default
It must be explicitly enabled
It can be centrally managed and enforced via Intune
Dependency Behavior
This setting has a dependency on the firewall state.
Dependency Type: DependsOn
Dependency URI: ./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableFirewall
Required Value: true
This ensures that dropped packet logging is only active when the firewall itself is enabled.
Allowed Values
This section defines the valid configuration values supported by the policy.
The setting uses a boolean format and supports the following values:
false (Default) Disable logging of dropped packets
true Enable logging of dropped packets
When set to true, Windows Firewall records all dropped packets in the system log file, allowing administrators to analyze blocked network activity.
How to Configure Firewall Dropped Packet Logging Using Intune (Settings Catalog)
This section demonstrates how to configure and enforce dropped packet logging using Microsoft Intune.
The Settings Catalog provides a centralized and scalable way to manage Windows Firewall configurations across all managed devices, ensuring consistency, visibility, and compliance with organizational security standards.
By enabling this configuration through Microsoft Intune, organizations can ensure that all endpoints generate logs for denied network traffic, supporting both security monitoring and troubleshooting efforts.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshot.
Create the Configuration Profile
In the Microsoft Intune admin center:
Navigate to Devices
Select Windows
Click Configuration
Select + Create policy
In the Create a profile pane:
Platform: Windows 10 and later
Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy.
In the next steps, you will search for and configure the setting responsible for Enabling dropped packet logging in Windows Firewall.
This configuration ensures that Windows Firewall records denied network traffic, providing administrators with visibility into blocked connections and enabling more effective monitoring, analysis, and troubleshooting.
Define Basic Profile Details
After creating the configuration profile, the next step is to define its basic details.
This stage plays a critical role in policy organization, governance, and long-term manageability within Microsoft Intune, especially in environments that include multiple security baselines and endpoint hardening configurations.
A well-structured naming convention and a clear description help administrators quickly identify the purpose of the policy, reducing operational complexity and avoiding misconfigurations over time.
Providing a clear Name and a concise but meaningful Description ensures that the intent of the policy is immediately understood by IT and security teams.
As shown in the screenshot, configure the fields as follows.
Policy Name and Description
Name: WIN – Endpoint Hardening – Firewall Dropped Packet Logging
Description: Enables logging of dropped packets in Windows Firewall to provide visibility into blocked network traffic. This configuration helps security teams detect suspicious activity, analyze denied connections, and improve troubleshooting by recording firewall events associated with dropped packets.
The Platform field is already pre-selected as Windows, so no changes are required.
Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows Firewall setting to enforce.
This step is where the configuration becomes effective, allowing Intune to control how Windows Firewall handles dropped packet logging across managed devices.
Click Add settings to open the Settings picker panel.
By default, this setting is not configured, which means Windows will follow its default behavior and will not log dropped packets unless explicitly enabled.
Without this configuration, blocked network traffic remains invisible, limiting visibility for security monitoring and troubleshooting.
As shown in the screenshot, use the search field at the top of the Settings picker and type:
Enable Log Dropped Packets
Then click Search to filter the results.
From the returned results:
Select the category: Firewall
Choose the setting: Enable Log Dropped Packets
Once selected, the setting is added to the configuration profile.
Back on the configuration page, change the value from its default state (false) to:
Enabled (true)
Enable Logging Of Dropped Packets
When enabled, Windows Firewall records all dropped packets in the system log, providing visibility into blocked network traffic.
This allows administrators to:
Identify suspicious connection attempts (such as port scanning)
Detect potential unauthorized access attempts
Troubleshoot network connectivity issues more effectively
Improve overall security monitoring and incident response
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles, ensuring that network activity is not only controlled but also fully observable.
After configuring the setting, click Next to continue with the profile deployment steps.
Configure Scope Tags (Optional)
This step focuses on administrative visibility and control within Microsoft Intune.
Scope tags are used to define which administrators can view and manage this policy, making them especially important in environments with delegated administration, multiple IT teams, or segmented operational models.
While this setting does not directly impact the behavior of the policy on endpoints, it plays a key role in maintaining proper governance and access control within the Intune environment.
As shown in the screenshot, the Default scope tag is selected.
The Default scope tag is the standard configuration and is recommended for most environments, as it ensures the policy remains visible to all administrators with appropriate Intune permissions.
Optionally, custom scope tags can be assigned if your organization requires more granular administrative control. This is particularly useful to:
Restrict policy visibility to specific IT roles or teams
Enforce separation of administrative responsibilities
Support regional or department-based management models
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Firewall Dropped Packet Logging Policy
After configuring the policy settings, the next step is to assign the policy to the appropriate target group.
Assignments define which devices will receive and enforce the configuration, ensuring that the policy is deployed in a controlled, predictable, and secure manner.
A well-planned assignment strategy is essential to avoid unintended impact, especially when dealing with security-related configurations.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target.
This approach allows organizations to follow a phased deployment strategy, starting with test devices before expanding to broader production environments.
As shown in the screenshot, the policy is assigned to the following group:
GRP – MS365Education – Test Computers
Once the group is selected, verify the following:
The group appears under Included groups
The group status is Active
No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is the recommended approach for controlled test deployments.
This ensures that:
Only intended devices receive the policy
Testing can be validated before wider rollout
Risk of unintended configuration impact is minimized
A structured assignment process is critical for maintaining consistency, reducing risk, and ensuring that endpoint hardening policies are applied effectively across the environment.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy.
This is where you validate that all configurations are correct and aligned with your intended endpoint hardening and network visibility objective, ensuring that dropped packet logging is properly configured across targeted devices.
Pay special attention to the following items.
Policy name and description
Confirm that the policy clearly reflects its purpose: enabling firewall dropped packet logging to provide visibility into blocked network traffic, supporting security monitoring, threat detection, and troubleshooting.
Configuration settings: Verify that the following setting is correctly configured: Enable Log Dropped Packets = True
Also ensure that:
Windows Firewall is enabled for the selected profile
Logging is applied to the intended network profile (Domain, Private, or Public)
Scope tags: Ensure the correct scope tag is assigned. In most environments, the Default scope tag is used to maintain visibility across administrative roles.
Assignments: Confirm that the policy is assigned to the intended group: GRP – MS365Education – Test Computers
Also verify that:
The group is active
No unintended exclusions are configured
This final review step helps prevent:
Misconfigurations
Incorrect targeting
Deployment scope issues
This is especially important in environments with multiple security baselines, delegated administration, and layered endpoint protection strategies.
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Firewall Dropped Packet Logging configuration profile, the next step is to verify its deployment status.
This validation confirms that the policy has been successfully applied and that Windows is actively logging dropped packets on the targeted devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
Triggering a manual device sync from the Company Portal
Initiating a sync directly from the Microsoft Intune admin center
Monitoring deployment ensures that the firewall logging policy is active and operating as intended.
How to Verify Policy Deployment Status
To review the deployment results:
In the Microsoft Intune admin center, navigate to Devices ➝ Configuration profiles
Use the search bar to locate the profile: WIN – Endpoint Hardening – Firewall Dropped Packet Logging
Select the policy to open the Overview page
Review Deployment Metrics
Microsoft Intune provides clear indicators to evaluate the policy deployment status:
Succeeded – Devices have successfully applied the policy
In progress – Devices are still processing the configuration
Error – The policy failed to apply and requires investigation
Not applicable – The device does not support the configuration
When devices report Succeeded, it confirms that Windows is enforcing the configuration: Enable Log Dropped Packets = True
This ensures that:
Dropped network packets are being logged
Blocked connections are recorded for analysis
Security visibility is active across managed endpoints
This verification step confirms that the endpoint hardening control is successfully deployed and that firewall logging is actively contributing to security monitoring and operational visibility.
Why This Validation Matters
Monitoring the deployment status ensures that the firewall dropped packet logging policy is correctly enforced across managed devices.
It confirms that:
Dropped packet logging is actively enabled
Windows Firewall is recording blocked network traffic
There are no deployment failures or unsupported devices
The endpoint security baseline remains consistent across the environment
This final validation step completes the policy lifecycle from configuration and deployment to enforcement and verification.
Security hardening is only effective when it is verified.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the WIN – Endpoint Hardening – Firewall Dropped Packet Logging policy was successfully applied.
This validation helps ensure that dropped packet logging is actively enforced at the operating system level and that blocked network traffic is being recorded as expected.
Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
How to Verify
Open Event Viewer on the target device
Navigate to: Applications and Services Logs ➝ Microsoft ➝ Windows ➝ DeviceManagement-Enterprise-Diagnostics-Provider ➝ Admin
Select Filter Current Log
Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
Open the event details and confirm that the Enable Log Dropped Packets setting was applied
Pro Tip
Match the event timestamp with the device’s most recent Intune sync.
Event IDs 813 and 814 are reliable indicators that the configuration policy was processed by the Windows MDM engine.
For deeper validation, you can also verify the firewall log file directly:
C:\Windows\System32\LogFiles\Firewall\pfirewall.log
This file confirms that dropped packets are being actively recorded by the system.
Why This Matters for Endpoint Security
Network visibility is a fundamental component of modern endpoint security.
Without logging, blocked traffic remains invisible, limiting the effectiveness of firewall protections.
By enabling dropped packet logging through Microsoft Intune and validating the configuration locally, organizations ensure that:
Blocked network traffic is recorded and available for analysis
Suspicious connection attempts can be identified
Security teams gain visibility into denied traffic patterns
Network activity aligns with security monitoring and detection strategies
This configuration enhances security visibility without impacting normal network operations.
Key Takeaway
Security hardening is not only about enforcing controls it is about gaining visibility into how those controls operate.
By enabling dropped packet logging through Microsoft Intune, organizations ensure that denied network traffic is no longer hidden, but instead becomes a valuable source of security insight.
Combined with centralized deployment and proper validation, this policy helps transform firewall behavior into a transparent and actionable security layer.
And in modern endpoint security, visibility is just as important as protection.
More Information
For additional technical details, refer to the official Microsoft documentation below:
https://learn.microsoft.com/en-us/windows/client-management/mdm/firewall-csp
https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you!
🖥️ Ricardo Barbosa
🎖️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect |💼 Technology Director at Altelix.com