[SOLVED] I cannot turn on windows firewall

GoldenJake7 · Apr 17, 2020

after the most recent windows update firewall has been off. I tried turning it on from the control panel I get error code 0x80070422 and when I try to run it from command prompt I get error 1058. I have been trying for days no online solution is working. Anyway my best guess is that the windows defender firewall authorization driver is missing I looked for it on services and device manager but I can't find it anywhere. Though I couldn't find any evidence of this issue happening on windows 10. Please help I'm desperate

Sysnative Windows Update · Apr 17, 2020

Hi!

Please do the following:

SFC Scan

Click on the Start button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator
When command prompt opens, copy and paste the following commands into it, press enter after each

sfc /scannow

Wait for this to finish before you continue

copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

GoldenJake7 · Apr 17, 2020

there it is

GoldenJake7 · Apr 17, 2020

Also this might help.
Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

Sysnative Windows Update · Apr 17, 2020

We can take care of these later, but they are just bugs and not real issues.

Farbar Service Scanner
1. Download Farbar Service Scanner from here, and move it to the Desktop
2. Right-click on FSS.exe > Run as Administrator
3. Checkmark everything, and click Scan

4. Once it finishes, Notepad will open FSS.txt on your Desktop. Copy and paste everything in it in your next reply

GoldenJake7 · Apr 17, 2020

Farbar Service Scanner Version: 14-12-2019
Ran by Dell (administrator) on 17-04-2020 at 17:09:36
Running from "C:\Users\Dell\Desktop"
Microsoft Windows 10 Pro (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is set to Disabled. The default start type is Auto.
The ImagePath of MpsSvc: "%SystemRoot%\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p".
The ServiceDll of MpsSvc service is OK.

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Policy:
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend: ""C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\MsMpEng.exe"".

Windows Defender Disabled Policy:
==========================

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed

**** End of log ****

Sysnative Windows Update · Apr 17, 2020

Can you try creating a new local admin user profile and testing it there?

GoldenJake7 · Apr 17, 2020

Farbar Service Scanner Version: 14-12-2019
Ran by jakes (administrator) on 17-04-2020 at 18:03:31
Running from "C:\Users\jakes\Desktop"
Microsoft Windows 10 Pro (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is set to Disabled. The default start type is Auto.
The ImagePath of MpsSvc: "%SystemRoot%\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p".
The ServiceDll of MpsSvc service is OK.

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Policy:
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend: ""C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\MsMpEng.exe"".

Windows Defender Disabled Policy:
==========================

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed

**** End of log ****

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

This is from a different local adminstrator account.

GoldenJake7 · Apr 17, 2020

can i switch to my original user now?

Sysnative Windows Update · Apr 17, 2020

I meant try turning on the Firewall from it.

GoldenJake7 · Apr 17, 2020

oh! sorry and no it doesn't work same errors

xilolee · Apr 17, 2020

Launch these commands from a command prompt to check the status of that driver (and report their results here):

Code:

sc qc mpsdrv
sc queryex mpsdrv
reg query hklm\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy

I get:

Read More:

GoldenJake7 · Apr 17, 2020

C:\Windows\system32>sc qc mpsdrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: mpsdrv
TYPE : 1 KERNEL_DRIVER
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : System32\drivers\mpsdrv.sys
LOAD_ORDER_GROUP : network
TAG : 0
DISPLAY_NAME : Windows Defender Firewall Authorization Driver
DEPENDENCIES :
SERVICE_START_NAME :

C:\Windows\system32>sc queryex mpsdrv

SERVICE_NAME: mpsdrv
TYPE : 1 KERNEL_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>reg query hklm\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
Enabled REG_DWORD 0x0

xilolee · Apr 17, 2020

Ant these:

Code:

sc qc bfe
sc queryex bfe
sc qc mpssvc
sc queryex mpssvc

Read More:

GoldenJake7 · Apr 17, 2020

C:\Windows\system32>sc qc bfe
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: bfe
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
LOAD_ORDER_GROUP : NetworkProvider
TAG : 0
DISPLAY_NAME : Base Filtering Engine
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\Windows\system32>sc queryex bfe

SERVICE_NAME: bfe
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 3316
FLAGS :

C:\Windows\system32>sc qc mpssvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: mpssvc
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
LOAD_ORDER_GROUP : NetworkProvider
TAG : 0
DISPLAY_NAME : Windows Defender Firewall
DEPENDENCIES : mpsdrv
: bfe
SERVICE_START_NAME : NT Authority\LocalService

C:\Windows\system32>sc queryex mpssvc

SERVICE_NAME: mpssvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

xilolee · Apr 17, 2020

Let's see what happens:

Code:

sc config mpssvc start= auto

GoldenJake7 · Apr 17, 2020

C:\Windows\system32>sc config mpssvc start= auto
[SC] OpenService FAILED 5:

Access is denied.

why does this happen?

xilolee · Apr 17, 2020

GoldenJake7 said:
C:\Windows\system32>sc config mpssvc start= auto
[SC] OpenService FAILED 5:

Access is denied.

why does this happen?

Did you run it from an elevated command prompt?

GoldenJake7 · Apr 17, 2020

if you mean I ran it as an administrator then yeah I did but otherwise I'm not sure what elevated means in this context

xilolee · Apr 17, 2020

Did you install another antivirus or an internet security?

Let's see what there is in the registry:

Code:

reg query hklm\system\controlset001\services\mpssvc /s

I get:

Read More:

Code:

C:\>reg query hklm\system\controlset001\services\mpssvc /s

HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc
    DependOnService    REG_MULTI_SZ    mpsdrv\0bfe
    Description    REG_SZ    @%SystemRoot%\system32\FirewallAPI.dll,-23091
    DisplayName    REG_SZ    @%SystemRoot%\system32\FirewallAPI.dll,-23090
    ErrorControl    REG_DWORD    0x1
    FailureActions    REG_BINARY    80510100000000000000000003000000140000000200000060EA00000200000060EA00000200000060EA0000
    Group    REG_SZ    NetworkProvider
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
    ObjectName    REG_SZ    NT Authority\LocalService
    RequiredPrivileges    REG_MULTI_SZ    SeAssignPrimaryTokenPrivilege\0SeAuditPrivilege\0SeChangeNotifyPrivilege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege\0SeIncreaseQuotaPrivilege
    ServiceSidType    REG_DWORD    0x3
    Start    REG_DWORD    0x2
    SvcHostSplitDisable    REG_DWORD    0x1
    SvcMemHardLimitInMB    REG_DWORD    0x1b
    SvcMemMidLimitInMB    REG_DWORD    0x14
    SvcMemSoftLimitInMB    REG_DWORD    0xc
    Type    REG_DWORD    0x20

HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Parameters
    ServiceDll    REG_EXPAND_SZ    %SystemRoot%\system32\mpssvc.dll
    ServiceDllUnloadOnStop    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Parameters\ACService

HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Parameters\AppCs
HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Parameters\PortKeywords

HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Parameters\PortKeywords\DHCP
HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Parameters\PortKeywords\IPTLSIn
HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Parameters\PortKeywords\IPTLSOut
HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Parameters\PortKeywords\RPC-EPMap
HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Parameters\PortKeywords\Teredo
HKEY_LOCAL_MACHINE\system\controlset001\services\mpssvc\Security
    Security    REG_BINARY    01001480900000009C000000140000003000000002001C000100000002801400FF000F000101000000000001000000000200600004000000000014008500020001010000000000050B000000000014009F000E00010100000000000512000000000018009D000E0001020000000000052000000020020000000018008500000001020000000000052000000021020000010100000000000512000000010100000000000512000000

[SOLVED] I cannot turn on windows firewall

Member

Inactive

Member

Attachments

Member

Inactive

Member

Inactive

Member

Attachments

Member

Inactive

Member

Moderator

Member

Moderator

Member

Moderator

Member

Moderator

Member

Moderator