9.2.5 Ensure 'Windows Firewall: Private: Logging: Size limit (KB)' is set to '16,384 KB or greater' - 16,384 KB or greater

Information

Use this option to specify the size limit of the file in which Windows Firewall will write its log information.

The recommended state for this setting is: 16,384 KB or greater.

Rationale:

If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users.

Impact:

The log file size will be limited to the specified size, old events will be overwritten by newer ones when the limit is reached.

Solution

To establish the recommended configuration via GP, set the following UI path to 16,384 KB or greater:

Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Logging Customize\Size limit (KB)

Default Value:

4,096 KB.

See Also

https://workbench.cisecurity.org/files/4286

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4, CSCv7|11.2

Plugin: Windows

Control ID: 3153bb6ad8a9593a1d1ea207a77d3427214c74531712288b431ca4dfd9a10bf2