Windows Fails to Start Windows Firewall Service

When I try to start windows fire wall i get a pop up telling me the service
isn't running, and I tell the pop-up to start the service.

It then says that the service has failed to start.

It gives me the service-specific error code 5. (0x5)

Any ideas on how to fix this?
Any way to reinstall the windows firewall service?

In the Start Search box type services.msc and press the Enter key. Make sure
all the services that say Automatic are started. Once they are all running
reboot the computer. You may have to do this a couple of times. I don't know
if this will work in Vista but I saw an XP computer with the exact same
symptom today. This procedure fixed it. Something had interrupted the
Windows Update process and many automatic services weren't starting on boot.
As soon as I started all the services manually Windows Update finished
installing something and a couple of reboots later all was good.

Well go to Services and start the FW service.

Did you even read my post? The service crashes on start.
That's what the error message came from.

I read your post. It still doesn't mean you couldn't go and manually start
the service. I suggest that if you have a retail version of Vista and it's
within the 180 days period of activation, then call MS for support. What I
suspect is maybe malware has taken out the FW.

I guess I'll call them.

I get those error messages WHILE TRYING TO MANUALLY START THE SERVICE by the
way, so your suggest made no sense.

Well, I have had a service terminate or stop that I have written. I went and
started the service and it started. So, it made perfect sense to me that you
went and tried to start a service manually.

Anyway, call MS and see if they can help you.

Like I said, you probably have malware that has compromised the machine and
it has taken/knocked out the FW, WITH YOU SITTING AT THE HELM, CAPTAIN. :)

[jaross20]

This worked for me:

Go into the registry editor and browse to the following keys. You will need to set the permissions for the following account NT Service\MpsSvc. The correct value is below the location path.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Epoch

Query Value;Set Value

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy

Full Control;Read

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Defaults\FirewallPolicy

Full Control;Read
For the DHCP Client service, the issue may occur if the “NT Service\DHCP” account does not have the necessary permissions for the following keys:

Registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Dhcp
permission needed: Query value, Create value, Enumerate Subkeys, Notify, Read Control

Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Dhcp\Configurations
permission needed: Full Control, Read

For the “Diagnostic Policy Service” service, the issue may occur when the account Trustedinstaller is missing the permissions for the key below:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\DPS\Parameters

permission needed: Full Control, Read

Source: http://support.microsoft.com/kb/943996

[WesStrueb]

Hi, jaross20;

It is with trepdiation that I would make changes to the registry, but in this case after taking a restore point, I would - except for two things:

One: I got the 6801 error mentioned above, too - not the error code 5. I don't know what difference this would make.

Two: How do I translate what you;ve posted and what Microsoft has put on its troubleshooting website into actual registry entries?

eg. you say -
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Epoch

Query Value;Set Value

What I see in the registry is -

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servi c es\SharedAccess\Epoch" in the "directory window" on the left, and -
"(default) REG_SZ (value not set)
Epoch REG_DWORD 0x0000098b (2443)"

in the edit window on the right.

How does what you say relate to what I see?

I am confused.

(btw, I'm running Windows Vista Home Premium, on an HP m8120n, w/ 3G RAM, originally with McAfee Security Center on it, which I pulled off recently. Connected to local network via ethernet cable.)

This may be related to the "Server Error in application "DEFAULT WEBSITE" I get on several websites I never got that message on before (like some of HP's links) and on my yahoo messenger advert url window...)

Anyway, please forgive one who has so far managed to avoided editing the registry in the past and so does not know the Rosetta Stone.

Thank you very much.

Thanks for the how-to on the regedit. I, too, had those already set as you describe.

Since I'm encountering other bizarre issues, I'm going to bite the bullet and restore to factory specs.

Thanks anyway! I do appreciate it.

[mparrish]

When you run Regedit and navagate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Epoch, you have to Right-Click on EPOCH and select Permissions. This will open the permissions for the EPOCH key. Select MpsSvc. The permissions for MpsSvc will be displayed with checkmarks showing you what level of permission the account has (you make have to select the Special Permissions button at the bottom of the Permissions window). Make sure that Query Value & Set Value are checked, if they are not check them and hit OK. You will need to do this for each Registry Key listed in the MS fix.

Personally, this did not fix my issue as the permissions were set correctly.