Raresoft Blog

As discussed in the previous posts in this series, there can be several causes that will prevent the Windows Firewall from starting. In this installment I will cover specifics of checking dependencies.

Checking Dependencies

When checking dependencies you will want to check to ensure that the default dependencies are in place, that there are not additional dependencies, and that the BFE and RPC services are starting.

Checking dependencies in Windows Vista and Windows Server 2008

As seen in the screenshots below, the Base Filtering Engine and the Windows Firewall Authorization Driver are the default dependencies. Use the steps below to view this:

1. Click Start
2. Right-click Computer
3. Click Manage
4. When Computer Management opens, open Services and Applications
5. Click Services
6. Right-click on Windows Firewall in the list of services and click Properties
7. Click the Dependencies tab

In addition, the Base Filtering Engine also has a dependency on RPC, as seen below.

Therefore, we also need to verify that the Base filtering Engine and the RPC service are started and set to start automatically as seen below.

Additional Dependencies

Finally, if there are any dependencies other than the ones mentioned above you will want to remove them.

Checking dependencies in Windows 7 and Windows Server 2008 R2

Windows 7 / Windows 2008 R2 have the same dependencies as Windows Vista but the services that have dependencies on them are different. Fortunately we are not concerned with what has a dependency on these services so we can check the same Base Filtering Engine and RPC services.

Conclusion

This is the last post of my series on troubleshooting issues where the Windows Firewall Service fails to start.

I hope you have found this information useful.

The Windows Firewall Service Fails to start – Checking Privilege Access

As discussed in the previous posts in this series, there can be several causes that will prevent Windows Firewall from starting. In this installment, part 4 of 5 in the series, I will cover specifics of checking access privileges for both Windows Vista and Windows 7.

Checking Privilege access

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

You can see the privilege access settings by looking at the RequiredPrivileges registry value.

I have listed the values you will find in a default clean install below but it is possible you will have other values.

HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc\RequiredPrivileges

1. SeAssignPrimaryTokenPrivilege
2. SeAuditPrivilege
3. SeChangeNotifyPrivilege
4. SeCreateGlobalPrivilege
5. SeImpersonatePrivilege
6. SeIncreaseQuotaPrivilege
7. 

You can then check the privileges found in the previous step using secpol.msc. Make sure each of the above listed privileges has LOCAL SERVICE listed in them.

You can check this by one of the following methods:

Method 1

Open secpol.msc, right click on root node (Security Settings) and export the data to an .inf file, open the .inf file in notepad.

Note: In the .inf file make sure the above listed privileges contain the SID of the needed object – for LOCAL SERVICE the SID is S-1-5-19

Note: This list below is edited to only contain the values we are looking for. There will be more values in the INF.

[Privilege Rights]
SeChangeNotifyPrivilege = *S-1-1-0,*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-32-545,*S-1-5-32-551
SeAuditPrivilege = *S-1-5-19,*S-1-5-20
SeIncreaseQuotaPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544
SeAssignPrimaryTokenPrivilege = *S-1-5-19,*S-1-5-20
SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6
SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6

Method 2

Open the Local Security Policy MMC (secpol.msc), then drill down to Local Policies / User Rights Assignment.

Find the Policy for the corresponding privileges (below) and make sure LOCAL SERVICE is listed in them.

Privilege name

Policy name

SeAssignPrimaryTokenPrivilege

Replace a process level token

SeAuditPrivilege

Manage auditing and security log

SeChangeNotifyPrivilege

Bypass traverse checking

SeCreatGlobalPrivilege

Create global objects

SeImpersonatePrivelege

Impersonate a client after authentication

SeUncreaseQuotaPrivilege

Adjust memory quotas for a process

Missing privileges can be added via Registry Editor as follows:

1. Browse to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\registry key, right click and select Permissions.
2. In the "Permissions for Creator Owner" window, click the Advanced button, then click Add.
3. 
4. Once the "Select User, Computer, Service Account or Group" box appears, change the "From this location:" to point to the local machine name if it is not already.
5. After changing the search location, enter "NT Service\BFE" for Windows Vista or "NT Service\MpsSvc" for Windows 7 in the "Enter the object name to select" box and click "Check names" – this will allow you to add the account. Click OK to return to the Advanced Security Settings dialog.
6. Check the appropriate privileges from above.

What’s next?

In my next installment, I will cover Firewall service dependencies.

As discussed in my previous posts in this series, there can be several causes that will prevent the Windows Firewall from starting. In this installment, part 3 of 5, I will cover specifics of checking registry permissions.

Checking Registry Permissions

You can verify the permissions in Registry Editor by right-clicking each of the following registry keys and choosing Permissions. Then, highlight the desired account and click Advanced. Then highlight the desired account (again) and click Edit.

Depending on the operating system version, either NT Service\MpsSvc or NT Service\BFE needs permissions for the following keys as described below (note that HKEY_LOCAL_MACHINE has been shortened to HKLM):

HKLM\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy

• Windows Vista: NT Service\BFE – Query Value, Set Value, Create Subkey, Enumerate Sub Keys, Notify, Read Control
• Windows 7: NT Service\BFE – Query Value, Set Value, Create Subkey, Enumerate Sub Keys, Notify, Read Control

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy

• Windows Vista: NT Service\MpsSvc – Full Control
• Windows 7: NT Service\MpsSvc – Query Value, Set Value, Create SubKey, Enumerate SubKeys, Notify, Delete, Read Control

HKLM\SYSTEM\CurrentControlSet\Services\ShareAccess\Epoch

• Windows Vista: NT Service\MpsSvc – Query Value, Set Value
• Windows 7: NT Service\MpsSvc – Query Value, Set Value

HKLM\SYSTEM\CurrentControlSet\Services\ShareAccess\Epoch2

• Windows 7: NT Service\MpsSvc – Query Value, Set Value

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

• Windows Vista: NT Service\MpsSvc – Full Control
• Windows 7: NT Service\MpsSvc – Query Value, Set Value, Create SubKey, Enumerate SubKeys, Notify, Delete, Read Control

Reviewing registry permissions for Windows Vista:

Reviewing registry permissions for Windows 7:

What’s next?

In my next blog post in this series, I will cover access privileges.

This is part two in my series on Windows Firewall failing to start. In part one, I covered Windows XP and gave an overview of the issues seen in Windows Vista and Windows 7. As discussed, there can be several causes that will prevent the firewall from starting. In this post, I will cover specifics of checking the logon permissions.

Checking Logon Permissions

First you should verify that the "Log on as:" account is set to Local Service. The Base Filtering Engine, Windows Firewall, and NLA services should all be set to Log on as the "Local Service" account. I’m only including one screenshot as an example because it is the same for all of the services that use Local Service. Note that the Password fields are ignored for this account. For more information on the Local Service account, refer to http://msdn.microsoft.com/en-us/library/ms684188(VS.85).aspx.

IPsec Policy agent uses the "Network Service" account.

Next we will want to verify the security descriptor definition language string, or SDDL string. This string defines the string format that the ConvertSecurityDescriptorToStringSecurityDescriptor and ConvertStringSecurityDescriptorToSecurityDescriptor functions use to describe a security descriptor as a text string. Refer to http://msdn.microsoft.com/en-us/library/aa379570(VS.85).aspx for more information.

We can use SC SDSHOW to show the SDDL string for the services of interest.

Syntax: sc sdshow <Service Name>

Note: You will want to run this command against a working machine in your environment for comparison but here are the default settings from a clean install.

Windows 7 default installation

Service Name: NLASVC

D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A

;;CCLCSWRPLORC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPRC;;;S-1-5-80-3141615172-2

057878085-1754447212-2405740020-3916490453)

Service Name: BFE

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWRPWPDTLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Service Name: MPSSVC

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR

RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCRP;;;S-1-5-80-2006800713-1441093265-249754

844-3404434343-1444102779)S:(AU;FA;CCDCKCSWRPWPDTLOCRSDRCWDWO;;;WD)

Service Name: SharedAccess

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWRPWPDTLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Windows Vista default installation

Service Name: NLASVC

D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A

;;CCLCSWRPLORC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPRC;;;S-1-5-80-3141615172-2

057878085-1754447212-2405740020-3916490453)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Service Name: BFE

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWRPWPDTLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Service Name: MPSSVC

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR

RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCRP;;;S-1-5-80-2006800713-1441093265-249754

844-3404434343-1444102779)S:(AU;FA;CCDCKCSWRPWPDTLOCRSDRCWDWO;;;WD)

Service Name: SharedAccess

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWRPWPDTLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Using SC SDSET to set the SDDL string

You can restore the default permissions via the SDDL strings above or get similar data from a working machine in your own environment.

SC sdset <Service Name> <SDDL string>

Example:

SC sdset SharedAccess D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

Notice that the end of each is SY = Local System, BA = Administrator, AU = Authenticated Users, PU = Power Users

What’s next?

In the next installment of this series, I will cover registry permissions as related to Windows Firewall.

There can be several causes that will prevent the Windows Firewall from starting and I will attempt to cover them in this series of five blog posts. In this first post, I will cover Windows XP and Windows Vista / Windows 7 separately as they are two different services. Last I will cover one issue with OneCare. Note: Specifics on Windows Vista and Windows 7will come in a later blog post.

Windows XP

In Windows XP, the firewall service is named “Windows Firewall/Internet Connection Sharing (ICS)”, or SharedAccess service.

Typical errors seen as either popups or within event logs when the service fails to start are:

• Cannot start the Windows Firewall/Internet connection sharing (ICS) Service on local computer
• Error 2: The system cannot find the file specified
• Error 1705: While starting windows firewall and internet connection sharing services

Problems starting the Firewall Service in Windows XP are most commonly related to an issue with the Shared Access registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess

The quickest resolution is generally to rebuild the key. Instructions for doing this are in the following article, along with a FIXIT link:

You cannot start the Windows Firewall service in Windows XP SP2

Other things you will want to check are:

• Verify that the “Remote Procedure Call (RPC)” service is started
• Verify that the service is configured to logon as Local System Account, as shown below:

The above 3 items cover the vast majority of the issues with starting the Firewall in Windows XP.

Windows Vista and later (Windows 7, Windows Server 2008, and Windows Server 2008 R2)

In Windows Vista and later, the firewall service is “Windows Firewall” (MPSSVC); it combines both Firewall and IPsec functionality.

The first thing to check is that the Base Filtering engine (BFE) is running. There are a number of services dependent on the BFE service (including the Windows Firewall) that may also fail to start:

• IPsec Policy Agent (PolicyAgent)
• Windows Firewall
• IKE and AuthIP IPsec Keying Modules
• Internet Connection Sharing (ICS)
• Routing and Remote Access

In my experience most of the issues starting these services are related to permissions.

Typical errors seen in relation to starting this service are:

• Event ID: 7024 – The Windows Firewall service terminated with service-specific error 5 (0×5)
• Windows could not start the Base Filtering Engine service on Local Computer. Error 5: Access is denied.
• Windows could not start the IPsec Policy Agent service on Local Computer. Error 1068: The dependency service or group failed to start.
• Windows could not start the Network Location Awareness on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code -1073741288.
• The Windows Firewall service terminated with service-specific error 87 (0×57)
• Error 0×80004015: The class is configured to run as a security id different from the caller.
• The Windows Firewall service terminated with service-specific error 6801 (0x1A91).
• “net start mpssvc” in cmd.exe returns the system error 1297.

What to look for (specific details will be shared in a future blog post):

• Verify Log On permissions
• Verify registry permissions
• Verify privilege permissions
• Verify Service Dependencies
• Reset the default security permissions
• Verify that the TxR folder exists : %systemroot%\system32\config\TxR
• Verify the following registry keys by comparing them to a default Windows installation:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShareAccess

Windows OneCare

Lastly, I am including information about one issue that may be seen with the Windows OneCare Firewall Service. The following messages may be seen:

The Windows OneCare Firewall Service Could not Start

Urgent – Turn on Firewall

You will see this error in the Windows OneCare interface, with a red status action item asking you to enable the firewall. The action listed does not enable the firewall, however.

This issue is also very specific because the firewall settings in Windows OneCare are grayed out and cannot be modified.

To resolve this issue:

Use the steps below to ensure that the PATH environment variable contains the following path:

%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM

1. Click Start / Control Panel and open the System Icon.
2. In System, click the Advanced tab and then Environment Variables.
3. Ensure that in the lower box “System variables” that PATH exists. If Path does not exist click NEW and type in PATH as the variable name and enter the above path in the variable value.
4. If PATH already exists, highlight it and click Edit.
5. Under variable name, click at the end of the line to append the above mentioned path to the end of the current path. NOTE: BE SURE TO SEPERATE THE OLD PATH AND THE NEW PATH WITH A SEMI-COLON ( ; ).
6. Click OK to close the windows and restart the computer.

If this does not resolve the issue, try the following step:

1. Click Start / Run and type Regsvr32 %SystemRoot%\System32\wbem\wmidcprv.dll and click OK.
2. Restart the computer and test the firewall again.

If this does not resolve the issue, or if the problem does not match the description, please follow the steps in KB article 910659.

Conclusion

This wraps up my overview of how to troubleshoot issues starting the Windows Firewall Service. I will have some future blog posts with more specific details on the Windows Vista/Windows 7 steps.