Hello! I have Windows 2008 R2 standard server with SQL 2008 and Configuration Management system installed. This is virtual vmware server. After updates released 9.8.2011, inbound network connectivity to this server does not work because firewall service is not running. Outbound connection from this server works fine. Error messages: Windows could not start the Windows Firewall on Local Computer. Error code 5. and The Windows Firewall service terminated with spesific error Access is denied. I already did some fixes, but none of them solved the problem: netsh winsock reset secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbosem (this resets security permission of entire Windows OS) service is running with Local Service permission Windows Firewall Authorization Driver works propertly In registery key CurrentControlSet\services\mpssvc has been added NT Service\mpssvc account with full control Please help!

Please help! Any ideas? Next I have in mind, to start this virtual machine from 2008 R2 installation media, and try to recover or reinstall it.

I pull this up once again, if there would be any MVP starting his week at the office :) I have 2 other options in mind, before re-installing the system: - to renew WMI by deleting wbem\repository - to re-join server do domain What do you guys thing?

I´ve been fighting with this server whole evening. These has been tried not: - group policy with firewall service and rules has been applied - same GPO with firewall has been disabled - WMI has been rebuild - server has been dropped from domain to workgroup - service still not starting - server has been joined to domain again, no change

I´m aware of this article and I replaced 3 registery paths with copies I got from server where Firewall service works fine: http://blogs.technet.com/b/networking/archive/2011/06/08/the-windows-firewall-service-fails-to-start-introduction.aspx

Just pulling this up once again. After I copied registery keys from other server, even Base Filtering Engine fails to start now because of access denied. Local Service account is used to start this service, as it should by default.

Anyone? Please help! I tried 2 more things: - I started server in restore mode command promt and tried to do sfc /scannow with proper windir and winboot options. - I tried to repair WMI with wmimgmt.exe No help! Here are 3 important logs: Event 7023, WMI Driver service terminated, access is denied Event 7024, Windows Firewall service terminated, access is denied Event 10009, DistributedCOM cannot be found. Not installed or corrupted. You can install or repair the component.

I got firewall service up by resetting security inheritance of firewall registery key. Still, WMI driver service does not come up, and the bigger issue I have, I cannot join this machine back to domain. I have now DistributedCOM Event 10009 happening all the time. How can I reset the operating system settings by the best way?

Now I have another server with exact same situation...

above link has been moved here http://winplat.net/post/2011/10/07/Troubleshooting-for-Services-issue-on-Windows-2008-R2.aspx

I needed the permission for Epoch2 as well. Thank you for documenting this. After adding the additional step for key on Epoch2 the firewall started right up again.

Thanks, the link you refer to helped me quite a bit. I took shortcuts and just gave the "Everyone" account the "Full Control" and "Read" permission on all of the keys listed, but it seems to have fixed the problem. Very important to note is that in my case, the problem was initially caused by a virus - getting rid of the virus is of course top priority. Windows Security Essentials could remove the virus, but it DID NOT detect the virus during quick scans, I had to do a full scan before it found the virus. My PC was Win7 Ultimate 64-bit.