Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently installed Wireshark on a Win 7 host, but now it won't let me start the NPF service. I get:

C:\Windows\system32>net start npf
System error 5 has occurred.

Access is denied.

That's strange, because I am in the local admins group, and the SDDL string for the 'npf' service shows that the RP and WP permissions are allowed to the built-in administrator group.

C:\Windows\system32>net localgroup

Aliases for \\DOC

*Backup Operators
*Cryptographic Operators
*Distributed COM Users
*Event Log Readers
*Network Configuration Operators
*Offer Remote Assistance Helpers
*Performance Log Users
*Performance Monitor Users
*Power Users
*Remote Desktop Users
The command completed successfully.

C:\Windows\system32>sc sdshow npf


Clearly I am missing something, but what?

share|improve this question
WinPCap 4.1.2 I even un-installed and re-installed it. Then, as the same user, failed to start it using "net start npf". :-( McAfee is running on the machine, but isn't jumping up and down about stuff. – David Bullock Nov 16 '11 at 13:26
I even re-booted. Same problem. – David Bullock Nov 16 '11 at 14:01
Altough it might not be the solution you want, have you tried something like sc sdset (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;YOUR_USER_SID) assuming that it's not something silly like executing from the wrong user. EDIT: And check your GPO – user Nov 16 '11 at 14:15
I can try assigning direct to a user, although I didn't want to have to (like you suspected). Thanks for the link to the GPO info. 1am here ... a job for the morning, to be sure. (edited) – David Bullock Nov 16 '11 at 14:23
up vote 3 down vote accepted

It sounds like you're not running it from an elevated command prompt. From the GUI you can click Start > Type cmd > right click > Run As Administrator and try again.

From an unelevated command prompt you can do runas /user:domain\user cmd

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.