Firewall Service Missing, Error 0x6D9

This article is intended for a technical audience. This article is primarily about Windows 7 but may be applicable for Windows Vista and Windows 8 also.

When opening Windows Firewall with Advanced Security, the following error is displayed:

There was an error opening the Windows Firewall with Advanced Security snap-in.
The Windows Firewall with Advanced Security snap-in failed to load. Restart the Windows Firewall service on the computer you are managing. Error code: 0x6D9

This may occur if the Windows Firewall service is missing or not started.

If Windows Firewall does not appear in the Services.msc applet:

1. Open an elevated command-prompt and type:

   regsvr32 FirewallAPI.dll

2. Press F5 to refresh the Services applet display. The service should appear.

3. Right-click the service and choose Start.

If the service does not start, this may be due to permission errors on various registry keys. The following Microsoft article discusses repairing the permissions either manually or with an automated troubleshooter tool: Some services do not start in Windows Vista and Windows 7. However this article does not take into account that the ACL entries for MpsSvc or RpcSs are absent, or that entire keys are absent.

To create an ACL entry for RpcSs and MpsSvc, the Object must be specified as NT SERVICE\MpsSvc and NT SERVICE\RpcSs and the Location must be the local machine (as opposed to any domain the computer is joined to).

MpsSvc needs Query Value and Set Value access to:

• HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\Epoch

• HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\Epoch2

MpsSvc needs Full Access to:

• HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy

• HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

RpcSs and MpsSvc need Notify access to:

• HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords

If Windows Firewall still doesn't start, compare the above keys with those on a working system. Use Process Monitor to determine where other ACCESS DENIED errors are coming from.