# Cannot start Windows Firewall Service.



## nalixor (Jul 27, 2011)

Hey guys,

I have often come here in the past to help me with various tech related woes, but I've never needed to post before. But now I do since I can no longer turn my Windows Firewall Service on, through any means in which one can do so under normal circumstances. I'm running Windows Vista SP2. From Windows Security Centre it tells me "Security Centre can't turn on Windows Firewall." From Windows Firewall it tells me "Windows Firewall settings cannot be displayed because the associated service is not running. Do you want to start the Windows Firewall Service?" then when I click yes "Windows cannot start the Windows Firewall Service." when trying to start it manually from Administrative Tools \ Services it tells me "Windows could not start the Windows Firewall on Local Computer. For more information, review the System Event Log." and the only thing Windows Firewall related I have been able to find in the Event Log is "The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy. Error Code: 2147942413".

All the different fixes I have seen online either haven't helped, or I wasn't sure enough to try them all. What can I do that is short of a complete reinstall of Vista?

Thanks a lot.


----------



## joeten (Dec 4, 2008)

Hi and welcome to TSF have you tried running sfc /scannow How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7


----------



## nalixor (Jul 27, 2011)

Thank you for the prompt reply. I am running the scan now. I'll post again when it's done.


----------



## nalixor (Jul 27, 2011)

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of them.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

Here is the log file: http://users.on.net/~n.skopec/CBS.log (since it was too big for this forums limits).


----------



## joeten (Dec 4, 2008)

Hi have a look at post 13 and 14 and see if they can help Security centre can't turn on windows firewall?? - Vista Help


----------



## nalixor (Jul 27, 2011)

Okay, I followed the steps in posts 13 and 14 of that thread, and this is what happened.

C:\Users\Nikola>winmgmt /verifyrepository
WMI repository is consistent

C:\Users\Nikola>net stop winmgmt
The following services are dependent on the Windows Management Instrumentation s
ervice.
Stopping the Windows Management Instrumentation service will also stop these services.

Security Center
Pure Networks Platform Service
IP Helper
Intel(R) Matrix Storage Event Monitor

Do you want to continue this operation? (Y/N) [N]: y
The Security Center service is stopping.
The Security Center service was stopped successfully.

The Pure Networks Platform Service service is stopping.
The Pure Networks Platform Service service was stopped successfully.

The IP Helper service is stopping.
The IP Helper service was stopped successfully.

The Intel(R) Matrix Storage Event Monitor service is stopping.
The Intel(R) Matrix Storage Event Monitor service was stopped successfully.

The Windows Management Instrumentation service is stopping.
The Windows Management Instrumentation service was stopped successfully.

C:\Users\Nikola>cd %windir%\system32\wbem

C:\Windows\System32\wbem>ren repository repository.old

C:\Windows\System32\wbem>net start winmgmt
The Windows Management Instrumentation service is starting.
The Windows Management Instrumentation service was started successfully.

After I had done that, I tried starting the Firewall service again, through all avenues and still had the same problem.


----------



## joeten (Dec 4, 2008)

Hi can you try running a repair from a install or recovery disc


----------



## nalixor (Jul 27, 2011)

Unfortunately I do not have access to a install/recovery disc. My computer came pre-installed with Vista, and the company that I got it from has since gone bankrupt. Is there perhaps an image I can get somewhere on the net?


----------



## joeten (Dec 4, 2008)

Hi unfortunately no, I have asked for some other input here lets see if someone else has a possible solution


----------



## Fred Garvin (Sep 4, 2010)

Click your Start button and type Regedit into the search Box, then click on the Registry Editor in the list. On the menu, click Edit, then Find, then paste this into the find box *HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile*

Look on the right side where it says FireWallEnable and see what the number is in parenthesis, either a 0 or a 1.


----------



## jenae (Jun 17, 2008)

Hi in Joe's link it mentioned search type: WF.msc did you try that? If it opens then highlight the windows firewall advanced settings (first on the tree ) select "actions" and then restore defaults . Restart then repeat the procedure this time activate firewall through the WF.msc interface.
*Note:-*
Before you modify any registry settings (EnableFirewall) we would like to see all entries under that tree, enablefirewall is dependent on quite a few entries, I do not want you poking about in there for the moment.


----------



## nalixor (Jul 27, 2011)

Hey guys, thank you so much for your help.

When I run WF.msc I get the Windows Firewall with Advanced Security popup in which it in the middle window it says "There was a error opening the Windows Firewall with Advanced Security snap-in" "The Windows Firewall with Advanced Security snap-in failed to load. Restart the Windows Firewall service on the computer that you are managing. Error Code: 0x6D9."

And in Regedit under *HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile* I have the following Values:

Default = (blank)
Disabled Interfaces = "{FDDC1DA0-B6DF-4570-BD59-71FC96B8EA21},{71A4708E-8F46-42ED-B764-1884498C4065},{D3096C6A-A58E-4EDF-AF9D-112F0C537167}"
Disabled Notification = "0"
DoNotAllowException = "0"
EnableFirewall = "1"

Thanks again, guys. I really appreciate it.


----------



## Jay_JWLH (Apr 30, 2008)

Ensure that the following services are set to automatic and started:
Application Layer gateway Service
Network Connections
Network Location Awareness
Telephony
Remote Access Connection Manager
Plug and Play

Are you able to open up Local Security Policy without any problems?


----------



## nalixor (Jul 27, 2011)

Okay.

Application Layer Gateway was set on Manual and not started, I have set it to Automatic and Started the Service.
Network Connections was set to Manual and it was already started, so I just set that to Automatic.
Network Location Awareness was set to Automatic and was already started, so I left that alone.
Telephony was set to Manual and was already started, so I set that to Automatic.
Remote Access Connection Manager was set to Manual and already started, so I set that to Automatic.
Plug and Play was set to Automatic and was already started, so I left that alone.

And I can open Local Security Policy just fine, should I be looking for anything in there?


----------



## nalixor (Jul 27, 2011)

Oh, it might be worth mentioning that I was still unable to start the firewall service after all that too.


----------



## jenae (Jun 17, 2008)

Hi, make sure you are logged on as your administrator account go to start search and type gpedit.msc press enter. Group policy editor will open.

In the left pane, click on to expand User Configuration, Administrative Templates, Windows Components, Microsoft Mangement Console, and Restricted/Permitted snap-ins.

With restricted/permitted snap-ins expanded scroll down till you see windows firewall with advanced security, double click this and select enabled apply and ok out.

Then go to start search and type WF.msc ,press enter highlight the first entry "windows firewall with advanced security" from the main menu select "action" then "restore defaults", you can set other conditions here if you wish.


----------



## nalixor (Jul 27, 2011)

I followed those instructions until the MF.MSC stage where I got the same screen I got last time I ran MF.MSC which was "There was an error opening the Windows Firewall with Advanced Security snap in" "The Windows Firewall with Advanced Security snap-in failed to load. Restart the Windows Firewall Service on the computer you are managing. Error Code: 0x6D9."


----------



## jenae (Jun 17, 2008)

Hi, well what is the status of the windows firewall service? Go to start search and type services.msc press enter locate the windows firewall service, right click it, click on properties and select "log on " what do you see? and has the service started and is it set to automatic.


----------



## nalixor (Jul 27, 2011)

That's what my orginal problem was, you see. I couldn't start the Firewall service no matter what I tried. Windows Firewall Service is set to automatic, but it's status is "Stopped" and when I try and start it I get:

---------------------------
Services
---------------------------
Windows could not start the Windows Firewall on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 13.
---------------------------
OK 
---------------------------


----------



## jenae (Jun 17, 2008)

Hi, what AV program have you now and what AV programs have you had in the past, also the "log On" post#18 what have you there?


----------



## nalixor (Jul 27, 2011)

I don't have any AV installed or running right now, but I have used both AVG and ZoneAlarm (yes, I know that was a stupid move) in the past. ZoneAlarm was a very brief fling, but I did use AVG for a while.

In the log on section of the Windows Firewall Service where it says "Log on as:" it has "This account: Local Service" selected. It has a password and confirm password field, which seem to have something in them. But I never set any kind of password for that, and I don't even have a password for Vista (my account is the only account, and it has Admin privileges).
Under "You can enable or disable this service for the hardware profiles below:" it has "Undocked Profile" set as Enabled.

I've uploaded a screenshot.


----------



## nalixor (Jul 27, 2011)

I don't mean to be pushy or anything, but are any of you guys who helped me still around? I don't know what to do to fix my problem.


----------



## Fred Garvin (Sep 4, 2010)

nalixor, I'm afraid I don't have anything useful to add and Jenae has covered quite a bit. As far as the logon service and your screenshot above, that is normal and the way Windows services work. I'm tempted to suggest creating a thread in the virus section of the forum to make sure your clean, but that's nothing more than a guess.


----------



## jenae (Jun 17, 2008)

Hi, your problem is unusual and should have been fixed with sp1. Some of us are on the other side of the world so while you are up we are sleeping. I suspect this thread has the answer, you should definitively do the backup suggested you might also fist post the values you see under "shared access" itself, they may be what needs changing.



> Here is a possible solution. I got the same error. To fix it, I had to delete the existing firewall rules in the registry. It worked in my case, but since it involves registry changes, you have to be careful. It may not work in your case. Also some rules which were manually added will need to be re-created.
> 
> Here are the steps:-
> 
> ...


----------



## nalixor (Jul 27, 2011)

Hey, and thanks for all your help so far.

I followed those instructions, and there was already no entries in HKLM\System\CurrentControlSet\Sevices\SharedAccess\Parameters\FirewallPolicy\FirewallRules. I tried starting the service again and it still wouldn't start.


----------



## jenae (Jun 17, 2008)

Hi, my Nephew has been on my computer and may have answered some threads I cannot see any reference to it here, Like all teenagers it is all my fault, I should not have left him with access, he takes no responsibility. This will be rectified by his father. Sorry it's a mess, could you go to start search and type:- cmd... search will return cmd.exe right click on this and select "run as administrator" at the prompt type:-


```
netsh firewall reset
```
 (press enter) Restart computer.

See how you go now.


----------



## nalixor (Jul 27, 2011)

I just did that, and it said:

C:\Users\Nikola>netsh firewall reset
The service has not been started.

Should I still restart?


----------



## nalixor (Jul 27, 2011)

Just to update, doing netsh firewall reset and then restarting does nothing. The Firewall service still won't start.


----------



## jenae (Jun 17, 2008)

Hi, has the windows firewall worked since you removed this computer from the office system, was it part of a domain? I assume this machine has Vista Enterprise Business or Ultimate, since you indicate you could access GPEDIT, please confirm.


----------



## nalixor (Jul 27, 2011)

I am running regular old Vista Ultimate. And apparently I CAN access GPEDIT.msc. Also, the Firewall Service hasn't worked for quite a while, but it has recently become necessary to fix it.


----------



## jenae (Jun 17, 2008)

Hi, you still didn't let us know if this computer was on a domain? If it came from an office network, it most likely was and may have had some restrictions placed on it especially in regards to security (firewall in this case).

Your post #12 that registry key could you export it to desktop (call it SP.reg) right click the exported file and select "edit" it will open in notepad make sure it is correct. Now go back to regedit and right click on 

"DisabledInterfaces" select delete. Restart computer. try starting (services.msc) the Firewall.

If this fails we could try to rebuild Group Policy to an empty state.
Navigate to C:\windows\system32\GroupPolicy, right click on this and select copy open desktop and right click select paste a copy of group policy is available for backup. Go back and rename GroupPolicy to GroupPolicyOld. 

In the system32 folder right click select new "folder" create one called GroupPolicy. Open this and create two more empty folders one called "Machine" the other called "User" restart computer.

You now have a complete default group policy. See if the firewall will start (services.msc) and let us know how you get on... if this doesn't work you can restore back by undoing using the backups you created.

Next we can try to reset ALL services to default run the attached .zip file it opens a DefaultVista Ultimate.reg file, right click on this and select "*Merge*" Restart computer try (services.msc) Firewall.

View attachment defaultVistaUltimate.zip


If this fails I am out of ideas.. reinstall maybe best solution.


----------



## digisaster (Nov 17, 2012)

jenae said:


> ..
> 
> If this fails I am out of ideas.. reinstall maybe best solution.



I got the same problem, and i got it fixed
I did delete the complete structure under

_HKLM\System\CurrentControlSet\Sevices\SharedAccess\Parameters\FirewallPolicy

_And after this i could start the firewall, and could reset the settings

Take a look at Firewall service not starting on Windows Vista | www.digisaster.com
for the details


----------



## jenae (Jun 17, 2008)

Hi, thanks we did try that. Problem was the machine came from an office (I suspected it was not a legit sale) and had some other GP restrictions. When a machine from an office domain is sold ALL restrictions are usually removed OR the machine is formatted. 6 mths old now, still thanks for the link.


----------

