0

This evening I tried to rdp into my server 2008 box and was unable to. After poking around some I discovered that something is awry with my Windows Firewall. I did install 5 windows updates remotely earlier today but rolled those back in an attempt to see if that fixed the problem but had no luck.

Symptoms:

  • cannot rdp to machine (including from itself)
  • cannot ping machine
  • cannot connect to file share on machine
  • error message when attempting to open "windows firewall with advanced security" snap-in (there was an error opening the windows firewall with advanced security snap-in ... The Windows Firewall with Advanced Security snap-in failed to load. Restart the windows firewall service on the computer that you are managing. Error code: 0x6D9.
  • When I opened the "user-friendly" Windows Firewall it failed to load most of the gui elements, meaning, the title bar with close, minimize, and maximize buttons is present, the rest of the window has a white background with a yellow rectangle with rounded corners and a yellow triangle w/ an exclamation point is in the upper right. hope that made sense
  • "Windows Firewall" does not appear in the list of services

I ran a virus scan that found nothing.

How do I fix the firewall and hopefully restore the ability to rdp?

EDIT: Added at fission's request:

c:\>sc query mpsdrv

SERVICE_NAME: mpsdrv
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

c:\>sc query mpssvc

SERVICE_NAME: mpssvc
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1068  (0x42c)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

Those two registry keys do exist: HKLM\SYSTEM\CurrentControlSet\Services\mpsdrv & HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc

! The problem seems to be with the Base Filtering Engine, when I try to start it I get the following error: Windows could not start the Base Filtering Engine service on MYCOMPUTER. Error 15100: The resource loader failed to find MUI file.

EDIT2: I ran sfc /scannow and i found about 100 occurrences of "[SR] Cannot repair member file"... including several related to the firewall (ex: [l:32{16}]"Firewall.cpl.mui" of Networking-MPSSVC.Resources...). One of them mentioned wordpad.exe, which I tried to open, and it failed. I found here mentions of mounting the install.wim on the install media to copy the affected files over. I am downloading the appropriate AIK and will continue tomorrow evening.

EDIT FINAL: As this was a development box I ended up rebuilding it.

1
  • Could you please edit your question with the output of: sc query mpsdrv and sc query mpssvc. Also, could you please check whether these regkeys exist: HKLM\SYSTEM\CurrentControlSet\Services\mpsdrv and HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc.
    – fission
    Mar 3, 2010 at 6:47

4 Answers 4

1

We had almost the same problem on one of our Win2008 Server boxes today. The only exception was that we did in fact see the Windows Firewall process in the process listing, however, we were unable to start it up. The Event Log showed "Access Denied" as the reason.

Turns out something had messed up the permissions in the registry, so that the user dedicated to the firewall was unable to fire it up.

Check this out, even if it is for Vista: http://support.microsoft.com/kb/943996. It solved out problem :-)

1

Fix: Also had the error code 5 issue. Couldnt start the Windows Firewall on Server 2008 R2. First followed instructions on http://support.microsoft.com/kb/943996 (add all permissions). Then exported the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess key from a working box and imported to broken box. Rebooted and all's well :)

0

Any event log entries? I would run chkdsk this to make sure it's not part of a larger problem. You may be able to reset the firewall from the cmd line but if the service isn't running that may fail also. http://support.microsoft.com/kb/947709

3
  • I see no relevant event log entries. Chkdsk run was uneventful.
    – Chloraphil
    Feb 28, 2010 at 23:10
  • And resetting the firewall? It that fails then reset TCP/IP using NetSH, reboot and then try resetting the firewall again. support.microsoft.com/kb/299357 Post any errors.
    – Ed Fries
    Mar 1, 2010 at 1:49
  • i ran the ip reset command but the service is still not present in the services console. i tried netsh advfirewall reset but that failed b/c it could not contact the service.
    – Chloraphil
    Mar 1, 2010 at 4:06
0

In http://4sysops.com/archives/windows-server-2008-windows-firewall-with-advanced-security/, they come up with this line:

netsh advfirewall set allprofiles settings remotemanagement enable

I've had a lot of trouble with remote management of security settings, too. The command line is much more powerful when it comes to getting firewall settings straight. This is also true, for example, when trying to allow your server to accept FTP connections.

1
  • i wasn't attempting to manage remotely.
    – Chloraphil
    Feb 28, 2010 at 23:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .