Windows Fails to Start Windows Firewall Service

Discussion in 'Windows Vista Security' started by Jacob, May 25, 2007.

  1. Jacob

    Jacob Guest

    When I try to start windows fire wall i get a pop up telling me the service
    isn't running, and I tell the pop-up to start the service.

    It then says that the service has failed to start.

    It gives me the service-specific error code 5. (0x5)

    Any ideas on how to fix this?
    Any way to reinstall the windows firewall service?
     
    Jacob, May 25, 2007
    #1
    1. Advertisements

  2. Jacob

    Jacob Guest

    This is from the Event logger

    - System

    - Provider

    [ Name] Service Control Manager
    [ Guid] {555908D1-A6D7-4695-8E1E-26931D2012F4}
    [ EventSourceName] Service Control Manager

    - EventID 7024

    [ Qualifiers] 49152

    Version 0

    Level 2

    Task 0

    Opcode 0

    Keywords 0x80000000000000

    - TimeCreated

    [ SystemTime] 2007-05-25T20:19:22.000Z

    EventRecordID 19697

    Correlation

    - Execution

    [ ProcessID] 0
    [ ThreadID] 0

    Channel System

    Computer Joshua

    Security


    - EventData

    param1 Windows Firewall
    param2 5 (0x5)





    The Windows Firewall service terminated with service-specific error 5 (0x5).
     
    Jacob, May 25, 2007
    #2
    1. Advertisements

  3. Jacob

    Mr. Arnold Guest

    See if you can reset the firewall. The procedure for XP will work on Vista.

    http://www.winxptutor.com/sp2/resetfw.htm

    If that doesn't work, then you should get on the phone with MS, if you have
    a retail version of Vista. Upon the activation of Vista, you have 180 days
    of free support.
     
    Mr. Arnold, May 25, 2007
    #3
  4. Jacob

    Jacob Guest

    NETSH FIREWALL RESET won't work, it says "The service has not been started."

    And the click by click process tells me to click an "Advanced" tab where no
    such tab is available.

     
    Jacob, May 25, 2007
    #4
  5. Jacob

    Kerry Brown Guest

    In the Start Search box type services.msc and press the Enter key. Make sure
    all the services that say Automatic are started. Once they are all running
    reboot the computer. You may have to do this a couple of times. I don't know
    if this will work in Vista but I saw an XP computer with the exact same
    symptom today. This procedure fixed it. Something had interrupted the
    Windows Update process and many automatic services weren't starting on boot.
    As soon as I started all the services manually Windows Update finished
    installing something and a couple of reboots later all was good.
     
    Kerry Brown, May 26, 2007
    #5
  6. Jacob

    Mr. Arnold Guest

    Well go to Services and start the FW service.
     
    Mr. Arnold, May 26, 2007
    #6
  7. Jacob

    Jacob Guest

    Did you even read my post? The service crashes on start.
    That's what the error message came from.
     
    Jacob, May 26, 2007
    #7
  8. Jacob

    Jacob Guest

    Ok, I organized them by start up type, these ones have start up type
    Automatic but will not start and are not started:

    Error Reporting Service
    MPICH2 Process Manager
    Windows Firewall
    Windows Media Center Service Launcher

    I can not start them. I get various error messages such as file not found,
    etc.
    Rebooting does nothing this problem has persisted for some time.
    Windows Update didnt fix it when I tried, but I'll run it again just for
    kicks.
     
    Jacob, May 26, 2007
    #8
  9. Jacob

    Kerry Brown Guest

    It sounds like you have a different problem. On the XP computer I was
    working on there were many services stopped.
     
    Kerry Brown, May 26, 2007
    #9
  10. Jacob

    Mr. Arnold Guest

    I read your post. It still doesn't mean you couldn't go and manually start
    the service. I suggest that if you have a retail version of Vista and it's
    within the 180 days period of activation, then call MS for support. What I
    suspect is maybe malware has taken out the FW.
     
    Mr. Arnold, May 26, 2007
    #10
  11. Jacob

    Jacob Guest

    I guess I'll call them.

    I get those error messages WHILE TRYING TO MANUALLY START THE SERVICE by the
    way, so your suggest made no sense.
     
    Jacob, May 27, 2007
    #11
  12. Jacob

    Mr. Arnold Guest

    Well, I have had a service terminate or stop that I have written. I went and
    started the service and it started. So, it made perfect sense to me that you
    went and tried to start a service manually.

    Anyway, call MS and see if they can help you.

    Like I said, you probably have malware that has compromised the machine and
    it has taken/knocked out the FW, WITH YOU SITTING AT THE HELM, CAPTAIN. :)
     
    Mr. Arnold, May 27, 2007
    #12
  13. Error 5 is typically 'Access Denied'.
    from an elevated command prompt, type 'net start mpssvc <enter>'. If the
    service doesn't start, type 'sc query mpssvc <enter>' and reply back with
    the output.

    Even if the service does start, we still need to investigate why it didn't
    start on its own.
    There are many reasons for it not to start. The easy ones are:
    1) another firewall on the box has turned it off to prevent configuration
    conflicts between the two programs.
    2) a service the firewall depends on is not starting
    3) a security profile has been applied to the machine which disables the
    service
    4) domain group policy has turned it off
     
    David Beder [MSFT], May 29, 2007
    #13
  14. Jacob

    Jacob Guest

    Wouldn't start.

    I think I had SDHelper at one point but that's all, and I don't see why that
    would mess up my firewall.

    Anyway, here's the sc query text:
    SERVICE_NAME:mpssvc
    TYPE: 20 WIN32_SHARE_Process
    STATE: 1 STOPPED
    WIN32_EXIT_CODE: 1066 (0x42a)
    SERVICE_EXIT_CODE: 5 (0x5)
    CHECKPOINT: 0x0
    WAIT_HINT: 0x0


    thanks for your help!
     
    Jacob, May 31, 2007
    #14
  15. Jacob

    Jacob Guest

    Microsoft Windows [Version 6.0.6000]
    Copyright (c) 2006 Microsoft Corporation. All rights reserved.

    C:\Users\Jacob>sc query mpssvc

    SERVICE_NAME: mpssvc
    TYPE : 20 WIN32_SHARE_PROCESS
    STATE : 1 STOPPED
    WIN32_EXIT_CODE : 1066 (0x42a)
    SERVICE_EXIT_CODE : 5 (0x5)
    CHECKPOINT : 0x0
    WAIT_HINT : 0x0

    C:\Users\Jacob>net start mpssvc
    The Windows Firewall service is starting.
    The Windows Firewall service could not be started.

    A service specific error occurred: 5.

    More help is available by typing NET HELPMSG 3547.


    C:\Users\Jacob>sc query mpssvc

    SERVICE_NAME: mpssvc
    TYPE : 20 WIN32_SHARE_PROCESS
    STATE : 1 STOPPED
    WIN32_EXIT_CODE : 1066 (0x42a)
    SERVICE_EXIT_CODE : 5 (0x5)
    CHECKPOINT : 0x0
    WAIT_HINT : 0x0
     
    Jacob, May 31, 2007
    #15
  16. interesting.
    how about some output from "sc qc mpssvc". I'm particularly interested in
    the value for service_start_name.

    Also, if you can fire up the services control panel, what are the settings
    on the log-on and recovery tabs?

    --
    David
    Microsoft Windows Networking
    This posting is provided "AS IS" with no warranties, and confers no rights.


     
    David Beder [MSFT], Jun 3, 2007
    #16
  17. Jacob

    Jacob Guest

    sc qc mpssvc returns:

    C:\Users\Jacob>sc qc mpssvc
    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: mpssvc
    TYPE : 20 WIN32_SHARE_PROCESS
    START_TYPE : 2 AUTO_START
    ERROR_CONTROL : 1 NORMAL
    BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k
    LocalServiceNoNe
    twork
    LOAD_ORDER_GROUP : NetworkProvider
    TAG : 0
    DISPLAY_NAME : Windows Firewall
    DEPENDENCIES : mpsdrv
    : bfe
    SERVICE_START_NAME : NT AUTHORITY\LocalService

    C:\Users\Jacob>


    Under the Log On tab for the Firewall service, "This Account" is selected
    and the account name "Local Service" with a password written in is entered.

    Recovery:
    First Failure- Restart Service
    2nd - Restart Service
    Susequent - Take no action

    Fail count reset every day, and the delay between failure restarts is 2
    minutes.
    The "Enable actions for stopes with errors." is not checked, and the rest is
    grayed out.
     
    Jacob, Jun 9, 2007
    #17
  18. Those are the default settings as I recall, so something doesn't appear to
    have 'adjusted' the service.

    maybe the issue is with mpsdrv, but I'd have thought you'd get a different
    error about a dependant service not being able to start.

    maybe the issue is with registry access.

    This is rather strange. I'll ask around and see if anyone can think of other
    things to check.

    --
    David
    Microsoft Windows Networking
    This posting is provided "AS IS" with no warranties, and confers no rights.


     
    David Beder [MSFT], Jun 10, 2007
    #18
  19. Jacob

    Jacob Guest

    Is there no way to simply reinstall the firewall, overriding the old install,
    with original settings?

    That way we could eliminate the firewall as the source of the problem,
    methinks.

    Furthermore, what password goes in those boxes? I never entered one, so do
    not know what it is, and could it be possible that a virus adjusted just the
    password field?

     
    Jacob, Jun 10, 2007
    #19
  20. I've always wondered what passwords were used also. I think they're
    auto-generated by the system.

    Might you have any restore points you can go back to?
    I haven't tried this in Vista, but in older versions of Windows, if you ran
    the setup cd again, you got a repair option that might put things back into
    order. Since Windows Firewall is part of the OS, you can't really just
    re-install just that service.

    On a slightly different note, how are the states of the BFE and MPSDrv
    services?
    Anything in the audit logs (ie eventvwr) about this services actually
    starting early during the boot sequence? One of the guys I work with was
    curious as to whether the service was crashing before you even got to log
    on, thus using up the 2-3crashes per boot quota.

    --
    David
    Microsoft Windows Networking
    This posting is provided "AS IS" with no warranties, and confers no rights.


     
    David Beder [MSFT], Jun 14, 2007
    #20
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.