Windows Firewall error 0x80070424: the service is missing or will not start

Fix it now

0x80070424 is Win32 error 1060, ERROR_SERVICE_DOES_NOT_EXIST: the Service Control Manager looked in its database and found no such service. In Windows Security that means the firewall service or something it depends on has been removed, disabled or damaged. It is not a rule problem, so editing rules gets you nowhere – and the same code appears in Windows Update for exactly the same reason.

sc query mpssvc
sc query bfe
sc qc mpssvc
sc config bfe start= auto
sc config mpssvc start= auto
net start bfe
net start mpssvc

1. Read the first two results. “The specified service does not exist” means the registration is gone and you are in the repair section below; a service that exists but is stopped or disabled is the easy case.
2. Note the dependency list sc qc mpssvc prints. Start what it depends on first, then the firewall service itself.
3. Once both are running, rebuild the rule set from defaults with netsh advfirewall reset – but export or record your custom rules first, because the reset discards them.
4. Confirm the result with Get-NetFirewallProfile | Select-Object Name, Enabled and by opening Firewall and network protection in Windows Security.
5. If a security suite was removed just before this started, run that vendor’s own removal tool, reboot, and repeat the checks.

If sc query wuauserv and sc query bits return the same complaint, you have one problem and not two. Error 1060 is about the service database, and the components that use it are incidental.

If both services run automatically after a reboot and Windows Security loads without a banner, stop here. If a service exists but still refuses to start, the next section covers what each refusal code means.

Why it happens

Windows Defender Firewall is not one component. The rules and profiles you see belong to the firewall service, MpsSvc, but the packet decisions are made by the Windows Filtering Platform, whose base component runs in the Base Filtering Engine service, BFE. Run sc qc mpssvc and the dependency is printed for you. If BFE will not start, MpsSvc cannot start, and the management interface has nothing to talk to.

Error 1060 is a specific statement, and it is worth taking literally. The Service Control Manager is not saying the service failed; it is saying there is no such service registered. That happens when a key under HKLM\SYSTEM\CurrentControlSet\Services has been deleted, or when its permissions have been changed so that the account the service runs as can no longer read it. Either way, nothing you do inside Windows Security will help, because there is no service behind the interface.

The companion codes describe the other two shapes this takes. 0x8007042C is error 1068, ERROR_SERVICE_DEPENDENCY_FAIL – the dependency service or group failed to start, which is BFE refusing while MpsSvc waits. 0x8007041D is error 1053, ERROR_SERVICE_REQUEST_TIMEOUT – the service did not respond to the start or control request in a timely fashion, meaning it exists, it launched, and it never reported ready. Microsoft documents that the Service Control Manager waits for the period set by ServicesPipeTimeout before logging events 7000 or 7011 in the System log.

Full reference

The three codes, as Microsoft states them

The 0x8007 prefix is the Win32 facility: everything after it is the plain Win32 error number in hexadecimal. That is why the same three codes turn up under Windows Update, Windows Search and half a dozen other components. They are statements about services, not about firewalls.

Working out which service is actually missing

1. sc query <name> tells you whether the service exists and what state it is in.
2. sc qc <name> prints its start type, the binary that hosts it, the account it runs as and what it depends on.
3. sc queryex <name> adds the process id, which is how you tell a service that is running from one that reports Running and has no process.
4. The System log, filtered on Service Control Manager, records events 7000 and 7011 with the reason a start failed or timed out.

Resetting the firewall, and what it costs

netsh advfirewall reset is documented as restoring policy defaults, and it does exactly that: every custom inbound and outbound rule you have added goes, and all three profiles return to their default state. On a machine where line-of-business applications rely on rules somebody added years ago, that is a real outage. Capture the current state first – Get-NetFirewallRule | Where-Object Enabled -eq True gives you a readable inventory – and be ready to put the important ones back.

Back up the registry before editing anything under Services. Select the branch, choose File then Export, and keep the .reg copy. Service keys carry the account and permission settings the operating system uses to start itself, and a mistake there is not recoverable from the desktop.

Seeing what the firewall is doing once it runs again

When the services are back, the fastest way to prove the firewall is making decisions rather than merely running is to turn its own logging on. Microsoft documents the log at %windir%\system32\logfiles\firewall\pfirewall.log, and it is enabled per profile with netsh advfirewall set allprofiles logging droppedconnections enable and the matching allowedconnections switch. For a fuller picture, the Security log records event 5157 when the Windows Filtering Platform blocks a connection, once the Audit Filtering Platform Connection subcategory is enabled.

Rebuilding a service that has genuinely gone

• Repair the component store first with SFC and DISM. Most missing service registrations are a symptom of component store damage rather than an isolated deletion.
• An in-place upgrade from current installation media rebuilds the service database while keeping applications, settings and data, and is the supported route when DISM cannot repair the store.
• Importing a service key exported from another machine works only if that machine is the same Windows version, build and architecture, and it is fragile enough that it should be a last resort rather than a first move.
• If the machine is a member of a domain with a standard build, reimaging is often faster than any of the above, and leaves you with a machine whose state you understand.

Every code this article covers

Confirm the fix worked

1. Get-Service MpsSvc, BFE reports both Running, with Automatic start type.
2. Get-NetFirewallProfile | Select-Object Name, Enabled shows all three profiles enabled.
3. Windows Security opens the Firewall and network protection page without an error banner.
4. sc query wuauserv and sc query bits no longer return the same complaint, which tells you the fault was the service database rather than the firewall alone.
5. Reboot and re-check, so you know the state survives a restart rather than having been started by hand.

Questions people ask about this