# lost Windows Firewall, cannot access it, turn it on/off



## samhfoley (Oct 5, 2009)

I am having a problem with Windows 8 64 bit system's Firewall. It is stopped, when I click run in services it says ---------------------------
Services
---------------------------
Windows could not start the Windows Firewall on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 5.
---------------------------
OK 
---------------------------
dependencies are
Base Filtering Engine
microsoft Windows Filtering Platform
Remote Procedure Call (RPC)
SCOM Server Process Launcher
RPC Endpoint Mapper
Windows Firewall Authorization Driver

I am running ESET 5 Antivirus

I was worried about Windows Command Processor. I keep getting a mysterious CMD window that would pop up everything I'd log into Windows. I was toying around with disabling all non Windows services and restarting to isolate the cause. It was when I went back to a normal boot that I had this happen. Ideas? Thanks in advance


----------



## samhfoley (Oct 5, 2009)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc
DisplayName REG_SZ Windows Firewall
ErrorControl REG_DWORD 0x1
Group REG_SZ NetworkProvider
ImagePath REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork
Start REG_DWORD 0x2
Type REG_DWORD 0x20
Description REG_SZ @%SystemRoot%\system32\FirewallAPI.dll,-23091
DependOnService REG_MULTI_SZ mpsdrv\0bfe
ObjectName REG_SZ NT Authority\LocalService
ServiceSidType REG_DWORD 0x3
RequiredPrivileges REG_MULTI_SZ SeAssignPrimaryTokenPrivilege\0SeAuditPrivilege\0SeChangeNotifyPrivilege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege\0SeIncreaseQuotaPrivilege
FailureActions REG_BINARY 805101000000000000000000030000001400000001000000C0D4010001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Security


----------



## samhfoley (Oct 5, 2009)

Log Name: System
Source: Service Control Manager
Date: 9/5/2012 6:16:29 AM
Event ID: 7024
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Rebirth
Description:
The Windows Firewall service terminated with the following service-specific error: 
Access is denied.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7024</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2012-09-04T21:16:29.421611000Z" />
<EventRecordID>5871</EventRecordID>
<Correlation />
<Execution ProcessID="720" ThreadID="836" />
<Channel>System</Channel>
<Computer>Rebirth</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Windows Firewall</Data>
<Data Name="param2">%%5</Data>
<Binary>4D00700073005300760063000000</Binary>
</EventData>
</Event>


----------



## Stancestans (Apr 26, 2009)

I've found a post that could help even thought it's for windows seven. Check this out here Windows 7 firewall service won’t start | Kent Oyer, but before you alter anything in the registry, create a backup of that key or better yet the whole registry.


----------



## joeten (Dec 4, 2008)

Thanks this might just help on another thread


----------



## samhfoley (Oct 5, 2009)

No go. Followed all steps, same story. No access.

Log Name: System
Source: Service Control Manager
Date: 9/5/2012 7:27:46 AM
Event ID: 7024
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Rebirth
Description:
The Windows Firewall service terminated with the following service-specific error: 
Access is denied.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7024</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2012-09-04T22:27:46.792823400Z" />
<EventRecordID>5938</EventRecordID>
<Correlation />
<Execution ProcessID="740" ThreadID="2084" />
<Channel>System</Channel>
<Computer>Rebirth</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Windows Firewall</Data>
<Data Name="param2">%%5</Data>
<Binary>4D00700073005300760063000000</Binary>
</EventData>
</Event>


----------



## Tomken15 (Dec 7, 2011)

This article may point you in the right direction Windows 8 Disable Firewall Group Policy


----------



## samhfoley (Oct 5, 2009)

refreshed Windows 8, problem solved. restore also failed...


----------



## Stancestans (Apr 26, 2009)

Refreshed windows 8? How do you mean?


----------



## samhfoley (Oct 5, 2009)

Startup option on Win 8 install disc. Refresh and erase settings or refresh and keep settings. I chose the latter. New Windows 8, with old settings. Minus program files of course.


----------

