Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This evening I tried to rdp into my server 2008 box and was unable to. After poking around some I discovered that something is awry with my Windows Firewall. I did install 5 windows updates remotely earlier today but rolled those back in an attempt to see if that fixed the problem but had no luck.

Symptoms:

  • cannot rdp to machine (including from itself)
  • cannot ping machine
  • cannot connect to file share on machine
  • error message when attempting to open "windows firewall with advanced security" snap-in (there was an error opening the windows firewall with advanced security snap-in ... The Windows Firewall with Advanced Security snap-in failed to load. Restart the windows firewall service on the computer that you are managing. Error code: 0x6D9.
  • When I opened the "user-friendly" Windows Firewall it failed to load most of the gui elements, meaning, the title bar with close, minimize, and maximize buttons is present, the rest of the window has a white background with a yellow rectangle with rounded corners and a yellow triangle w/ an exclamation point is in the upper right. hope that made sense
  • "Windows Firewall" does not appear in the list of services

I ran a virus scan that found nothing.

How do I fix the firewall and hopefully restore the ability to rdp?

EDIT: Added at fission's request:

c:\>sc query mpsdrv

SERVICE_NAME: mpsdrv
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

c:\>sc query mpssvc

SERVICE_NAME: mpssvc
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1068  (0x42c)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

Those two registry keys do exist: HKLM\SYSTEM\CurrentControlSet\Services\mpsdrv & HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc

! The problem seems to be with the Base Filtering Engine, when I try to start it I get the following error: Windows could not start the Base Filtering Engine service on MYCOMPUTER. Error 15100: The resource loader failed to find MUI file.

EDIT2: I ran sfc /scannow and i found about 100 occurrences of "[SR] Cannot repair member file"... including several related to the firewall (ex: [l:32{16}]"Firewall.cpl.mui" of Networking-MPSSVC.Resources...). One of them mentioned wordpad.exe, which I tried to open, and it failed. I found here mentions of mounting the install.wim on the install media to copy the affected files over. I am downloading the appropriate AIK and will continue tomorrow evening.

EDIT FINAL: As this was a development box I ended up rebuilding it.

share|improve this question
    
Could you please edit your question with the output of: sc query mpsdrv and sc query mpssvc. Also, could you please check whether these regkeys exist: HKLM\SYSTEM\CurrentControlSet\Services\mpsdrv and HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc. –  fission Mar 3 '10 at 6:47

4 Answers 4

We had almost the same problem on one of our Win2008 Server boxes today. The only exception was that we did in fact see the Windows Firewall process in the process listing, however, we were unable to start it up. The Event Log showed "Access Denied" as the reason.

Turns out something had messed up the permissions in the registry, so that the user dedicated to the firewall was unable to fire it up.

Check this out, even if it is for Vista: http://support.microsoft.com/kb/943996. It solved out problem :-)

share|improve this answer

Fix: Also had the error code 5 issue. Couldnt start the Windows Firewall on Server 2008 R2. First followed instructions on http://support.microsoft.com/kb/943996 (add all permissions). Then exported the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess key from a working box and imported to broken box. Rebooted and all's well :)

share|improve this answer

Any event log entries? I would run chkdsk this to make sure it's not part of a larger problem. You may be able to reset the firewall from the cmd line but if the service isn't running that may fail also. http://support.microsoft.com/kb/947709

share|improve this answer
    
I see no relevant event log entries. Chkdsk run was uneventful. –  Chloraphil Feb 28 '10 at 23:10
    
And resetting the firewall? It that fails then reset TCP/IP using NetSH, reboot and then try resetting the firewall again. support.microsoft.com/kb/299357 Post any errors. –  Ed Fries Mar 1 '10 at 1:49
    
i ran the ip reset command but the service is still not present in the services console. i tried netsh advfirewall reset but that failed b/c it could not contact the service. –  Chloraphil Mar 1 '10 at 4:06

In http://4sysops.com/archives/windows-server-2008-windows-firewall-with-advanced-security/, they come up with this line:

netsh advfirewall set allprofiles settings remotemanagement enable

I've had a lot of trouble with remote management of security settings, too. The command line is much more powerful when it comes to getting firewall settings straight. This is also true, for example, when trying to allow your server to accept FTP connections.

share|improve this answer
    
i wasn't attempting to manage remotely. –  Chloraphil Feb 28 '10 at 23:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.