Cannot Start Windows Firewall Service in 11 and 10

If the Windows Firewall service will not start, the number in the error message is the diagnosis — and the four common numbers have four completely different causes. 1068 means one of the three services it depends on is down. 5 means the registry permissions are damaged. 1079 means it is set to log on with the wrong account. 1058 means something disabled it. Open Services (press Windows key + R, type services.msc, press Enter), find Windows Defender Firewall, right-click it and choose Start — and whatever number comes back, take it to the matching section below rather than working through a generic list of fixes.

The $40 quote Jake did not need to pay

The billing laptop in Jake's shop started refusing Windows updates. Then Windows Security put a red cross next to the firewall, and clicking Turn on did nothing at all — no error, no change, the switch simply stayed where it was.

The shop next door told him it was a reinstall job. Forty dollars, drop it in tomorrow, back the day after. Which for a machine that takes card payments meant a day of writing things down on paper.

"Before you hand it over," Ethan said, "go into Services and start it by hand. Not the switch in Settings — the service itself. I want to see what it says when it fails."

It said Error 1068: The dependency service or group failed to start.

"Good. That's not a reinstall, that's a five-minute job. Something the firewall needs is switched off, and the firewall is being blamed for it."

That is the shape of this whole problem. The switch in Settings tells you nothing when it fails. The service tells you a number, and the number tells you which of four unrelated things is wrong. Almost every guide for this query skips that step and hands you the same list of five fixes to work through in the hope that one of them lands — which is how a five-minute repair turns into an evening, or a reinstall.

Before anything: is this actually a fault?

Thirty seconds here saves a wasted hour, because a firewall that is off on purpose looks identical to one that is broken.

Open Windows Security and go to Firewall & network protection. If a third-party security product has taken over, this page usually says so by name, and the Windows firewall being off is then correct behavior rather than a fault. Two firewalls filtering the same traffic is a genuine problem, so the products are built to stand aside for each other.

In that case the question is not how to start the Windows service. It is whether the other product's firewall is working, and that is answered in the other product.

If nothing else is installed and Windows Security shows the firewall off with no explanation, carry on down this page.

The dependency chain almost nobody gets right

Search this problem and you will be told, over and over, that the firewall depends on the Base Filtering Engine. That is true and it is incomplete, and the missing part is why people fix the Base Filtering Engine and still get error 1068.

On a current Windows 11 machine, the firewall service depends on three things. You can read it off your own computer rather than taking anyone's word for it. Open PowerShell and run:

The answer comes back as:

To see the state of all four at once:

Every one of them should say Running, and the three dependencies should be set to start automatically. Whichever one says Stopped is where your actual problem is — and if that is nsi or mpsdrv, every guide that only talks about the Base Filtering Engine was never going to fix your machine. If PowerShell is unfamiliar territory, our beginner's introduction to PowerShell commands covers what these two lines are actually doing.

Error 1068: the dependency service or group failed to start

The most common of the four, and the most satisfying to fix, because the firewall itself is fine. Something underneath it is not running, so it cannot start, and Windows reports the failure against the service you asked about rather than the one that actually failed.

Work bottom-up. In services.msc, start them in this order, checking each one actually reaches Running before moving on:

1. Network Store Interface Service — then 2. Base Filtering Engine — then 3. Windows Defender Firewall. The authorization driver mpsdrv starts on demand and does not usually need touching.

Or the same thing in an administrator PowerShell window:

While you are in Services, double-click each of the three and set Startup type to Automatic. A service that starts when you push it but not at boot will hand you the same problem back tomorrow morning.

If the Base Filtering Engine itself refuses, note its error number and take that number to the matching section below. That is the case that catches people: the number in front of you belongs to the firewall, but the number that matters belongs to the service beneath it.

Error 5: access is denied

This one confuses people because they are already signed in as an administrator, so denied to whom?

Not to you. Windows services run as their own limited accounts, and each one needs specific rights on the registry keys that hold its configuration. Error 5 means those permissions have been damaged — typically by a failed upgrade, a cleanup tool that tightened things it did not understand, an antivirus removal that took part of itself with it, or malware that did it on purpose.

The permissions that are supposed to be there

Open Registry Editor — Windows key + R, type regedit, press Enter. If that is unfamiliar, our guide to opening Registry Editor safely covers the ground rules first.

Navigate to:

Right-click the BFE key, choose Export and save a copy somewhere you can find it — that is your undo. Then right-click it again and choose Permissions.

NT SERVICE\BFE should be listed with Full Control. If it is missing, click Add, type NT SERVICE\BFE, click Check Names, and grant Full Control.

Then do the same at ...\Services\MpsSvc, where NT SERVICE\MpsSvc needs Read.

Restart the computer, then start the Base Filtering Engine before the firewall service.

If the permissions look correct and it still says 5

Then the damage is deeper than one key, and this is the point to stop hand-editing the registry. Move to the repair sequence below. Editing your way through service permissions one key at a time is a long evening with a poor success rate, and there is a supported route that does the same job properly.

Error 1079: the account specified is different

The full message is that the account specified for this service is different from the account specified for other services running in the same process. In plain terms: several services share one process, they must all run as the same user, and this one has been changed to something else.

It is a two-minute fix and it does not involve the registry.

In services.msc, double-click Windows Defender Firewall and open the Log On tab. Choose This account and type exactly:

Clear both password boxes completely and click Apply. That account has no password, so empty is correct — and this is the step people undo because it looks like a mistake.

Then repeat the whole thing for Base Filtering Engine, because if one service in the group has drifted the other frequently has too. Restart, and start the services bottom-up as above.

Error 1058, greyed-out Start, or "disabled"

Error 1058 means the service is disabled, or has no enabled devices associated with it. If Start is greyed out in the right-click menu, this is your case even without the number.

Double-click the service, set Startup type to Automatic, click Apply, and then Start. If the drop-down is greyed out too, something is holding it there, and there are three usual somethings:

• A security product that disabled it on installation, or on a botched uninstall. Uninstall it properly using the maker's own removal tool, not just Add or Remove Programs.
• Group Policy, on a work laptop. If the machine is managed by an employer, this is intentional and your IT team owns it. Do not fight it.
• Malware, which is worth taking seriously if other security components are also disabled.

A useful check on a home machine: reboot into Safe Mode and try to set it to Automatic there. If it works in Safe Mode and reverts in normal Windows, something running at startup is changing it back, and you now know to go looking for that instead.

No error number at all? Event Viewer has the real message

Sometimes the switch in Settings simply does nothing, or the service dialog gives a vague failure with no number. The information exists, it is just not being shown to you.

Press Windows key + R, type eventvwr.msc and press Enter. Go to Windows Logs → System, and look at the entries around the moment you tried to start the service. The ones you want have Service Control Manager as their source, and they say things the dialog box does not: which dependency failed, which account was refused, which error code was actually returned.

The log is long, so sort by time and start from your most recent attempt. Our post on working with Event Viewer covers the layout if it is new to you.

This is the single most underused step in Windows troubleshooting. Two minutes here replaces an hour of guessing, and it tells you whether you are looking at a permissions problem, a dependency problem or something else entirely.

The repair sequence, in the order that actually works

If the error-specific fixes did not land, or the damage is spread across several services, this is the escalation ladder. Do these in order and stop as soon as the service starts.

1. Repair the system files, DISM before SFC

Open an administrator command prompt and run, in this order:

The order matters and it is the reverse of what most guides say. sfc repairs damaged system files by copying good copies out of a local store. If that store is itself damaged, sfc finds problems it cannot fix and you get the familiar "found corrupt files but was unable to fix some of them" result. DISM with RestoreHealth repairs the store, which is why running it first makes sfc useful rather than frustrating.

Both take a while and DISM can look frozen at 20 percent for several minutes. Leave it alone. If DISM itself reports it could not repair, our post on DISM RestoreHealth still showing corrupted files covers the source-media route, and Windows Resource Protection could not start the repair service covers the case where sfc will not even run.

Restart afterwards. This step alone resolves a good share of these cases.

2. Reset the firewall rules — but only once it starts

An administrator command prompt, then:

Be clear about what this does and does not do. It returns every firewall rule to the shipped defaults, which fixes a firewall that runs but misbehaves. It does not fix a service that will not start, because there is nothing running for it to reset. Reach for it after the service is up, if the behavior is still wrong — the full walkthrough lives in our guide to resetting the firewall in Windows.

It also removes any custom rules you or your applications created, so games, backup tools and anything that opened a port will ask for permission again.

3. System Restore, if you have a point from before it broke

If the machine worked last week and the failure arrived with an update or an installation, a restore point from before that date is the shortest path there is. It rolls back system files, drivers and registry state while leaving your documents alone. If restore itself fails, our post on System Restore failing with error 0x80070091 covers the common reason.

4. In-place repair install — the step people skip

This is the one worth knowing about, because most people jump from "nothing worked" straight to "wipe it".

Download the installation media for your version of Windows, run setup.exe from inside the running system, and choose to keep personal files and apps. Setup replaces the system files and re-registers the services while leaving your programs, documents and most settings in place. It takes around an hour and it fixes the majority of "permissions and system files are damaged beyond repair" cases.

A full reinstall comes after this, not instead of it. Jake's forty-dollar quote was for the wrong job.

When to stop troubleshooting and start scanning

One stopped service after a failed update is ordinary. Several security components failing together is a pattern, and it is worth recognizing rather than working around.

Treat it as a possible infection if two or more of these are true at the same time:

• The firewall service will not start and keeps re-disabling itself after you fix it.
• Windows Defender real-time protection is off and will not switch on.
• Windows Update fails, or the update service is also stopped.
• Security websites will not load while everything else does.
• Registry Editor, Task Manager or services.msc close immediately when opened.

In that situation, do not run a normal scan from inside the running system — anything capable of disabling those services is capable of hiding from a scanner that starts after it does. Use an offline scan, which restarts the machine and scans before Windows loads. Ours is covered in what Windows Defender Offline is and how to run it, and once the machine is clean, real-time protection should be the first thing you confirm is back on.

Then come back to this page and fix the service, because the damage usually outlives the infection.

If this is a Windows 10 machine, one thing to know

Every command, service name and registry path above is identical on Windows 10, so nothing here changes for you. But this particular problem is worth one honest sentence about dates.

Windows 10 reached end of support on 14 October 2025. Without Extended Security Updates it no longer receives security patches. A machine whose firewall is off, on a system that is no longer being patched, is two gaps stacked on top of each other rather than one — which matters more here than it would on almost any other error.

Consumer ESU enrollment runs from Settings → Windows Update, and Microsoft extended that program in 2026, so an enrolled machine stays covered for a while yet. The current dates and what enrollment actually involves are in our post on when Windows 10 and 11 support ends. Fix the firewall first; then decide about the rest.

Questions people actually ask about this

Why will the Windows Firewall service not start?

In almost every case it is one of four things, and the error number tells you which. Error 1068 means one of the services it depends on is not running. Error 5 means the permissions on its registry keys have been damaged. Error 1079 means it is set to log on with the wrong account. Error 1058 means the service has been disabled, often by policy or by another security product. Read the number first, because the fix for one of them does nothing for the other three.

What does error 1068 mean when starting the firewall?

It means the dependency service or group failed to start. The Windows Defender Firewall service depends on three things, not one: the firewall authorization driver called mpsdrv, the Base Filtering Engine, and the Network Store Interface Service. Most guides mention only the Base Filtering Engine. Start the three of them first, in that order, and then start the firewall service, because it cannot run until all three are up.

How do I fix error 5 access denied on the firewall service?

Error 5 is a permissions problem on the registry keys the service reads at startup. In Registry Editor, open HKEY_LOCAL_MACHINE then SYSTEM then CurrentControlSet then Services then BFE, right-click it, choose Permissions, and make sure NT SERVICE BFE is listed with Full Control. Do the same for the MpsSvc key, where NT SERVICE MpsSvc needs Read. Back up the keys first, restart afterwards, and start the Base Filtering Engine before the firewall service.

What is the Base Filtering Engine and why does it matter?

The Base Filtering Engine is the Windows component that actually applies firewall and IPsec rules to network traffic. The firewall service you see in Settings is largely the management layer above it. That is why the firewall cannot start when the Base Filtering Engine is stopped, and why so many fixes for this problem are aimed at a service most people have never heard of. If it is stopped, nothing above it can work.

How do I fix error 1079 on the Windows Firewall service?

Error 1079 means the service is set to log on as a different account from the other services sharing its process. Open services.msc, double-click the service, go to the Log On tab, select This account, type NT AUTHORITY LocalService, clear both password boxes completely, and apply. Repeat it for the Base Filtering Engine, then restart. Leaving the password fields empty is correct and not an oversight, because that account has no password.

Is it safe to give Everyone full control of the BFE registry key?

It usually works and it is the most copied advice on this problem, but it is not what we would leave in place. You are widening permissions on a security component to repair it, which is a reasonable diagnostic step and a poor resting state. Use NT SERVICE BFE with Full Control instead, which is the permission that is supposed to be there. If you already applied the Everyone version and the firewall now starts, go back into Permissions and remove the Everyone entry.

Can I use my computer with the firewall service stopped?

You can, and you should not for any longer than the repair takes. A stopped firewall service is not the same as a firewall set to allow everything, it means the filtering layer is absent entirely, so inbound connections are not being evaluated at all. On a home network behind a router the immediate risk is lower, on public Wi-Fi it is not. If you must keep working, stay off untrusted networks until the service is running again.

Does a third-party antivirus turn the Windows firewall off?

Some security suites do, deliberately, because they install their own firewall and two filtering layers on the same machine cause problems. In that case Windows Security showing the firewall as off is correct behavior rather than a fault, and it usually says which product is managing it. Check that before troubleshooting anything, because forcing the Windows service back on while another firewall owns the job can leave you with a machine that has network problems and no obvious cause.

How do I reset Windows Firewall to its defaults?

Open an administrator command prompt and run netsh advfirewall reset, or use Restore defaults in the Windows Defender Firewall control panel. This clears every rule back to the shipped set. It fixes a firewall that starts but behaves wrongly, and it does nothing at all for a service that refuses to start, so do not reach for it until the service is actually running. Any custom rules you or an application added are gone afterwards and must be recreated.

Should I run sfc scannow or DISM first?

Run DISM first if you have any reason to think the system files are damaged. The system file checker repairs files by copying good versions out of a local store, so if that store is itself damaged the check reports problems it cannot fix. DISM with the RestoreHealth option repairs the store. The practical order is DISM RestoreHealth, then sfc scannow, then restart. Running them the other way round is the usual reason people report that sfc found errors and fixed nothing.

Could this be a virus?

It is worth ruling out, particularly if more than one thing is broken. A single stopped service after a failed update is ordinary. A machine where the firewall will not start, Defender will not turn on and Windows Update also fails is a recognized pattern, because disabling security components together is what malware does deliberately. If two or more of those are true, run an offline scan that starts before Windows does, rather than a normal scan from inside the running system.

What is the difference between Windows Firewall and Windows Defender Firewall?

Nothing except the name, which has changed more than once. The same component has been called Windows Firewall, Windows Defender Firewall and, in the Settings app, Firewall and network protection. Underneath it is one service whose short name is mpssvc, and that short name has stayed the same throughout. When a guide and your own screen disagree about the name, they are still talking about the same thing.

Where do I see the real error behind cannot start firewall service?

Open Event Viewer, go to Windows Logs then System, and look for entries whose source is Service Control Manager around the time you tried to start it. The ones that matter are the service failed to start, the service depends on another service which failed to start, and the service terminated with an error. Those entries name the dependency or the error code, which is exactly the information the small dialog box leaves out.

Will reinstalling Windows fix it, and is there anything to try first?

It fixes it, and it is almost never necessary. Before that, there is an in-place repair install, which runs setup from the current installation media, replaces the system files and keeps your apps, files and settings. It takes about an hour and resolves the majority of cases where permissions and system files are damaged beyond a simple repair. Keep a full reinstall as the option after that, not the first response to a service that will not start.

Does this work the same on Windows 11 and Windows 10?

Yes. The services, the error numbers, the registry paths and every command in this post are identical on both. Only the route through the interface differs, because Windows 11 puts the firewall under Privacy and security then Windows Security then Firewall and network protection, while Windows 10 reaches the same page through Update and Security. The services.msc route works the same on both and is the one worth learning.

What it turned out to be

The Base Filtering Engine on Jake's billing laptop was set to Manual and had never started that morning. An antivirus he had trialled months earlier and removed had left it that way, and nothing had needed it badly enough to complain until the day the firewall did.

Set it to Automatic, start it, start the firewall on top of it. Four clicks. The whole thing took less time than the phone call about the forty-dollar quote.

"So the error message was pointing at the wrong service the entire time."

"It was pointing at the service you asked about. It just wasn't the service that failed. That's most of Windows troubleshooting — the component that complains is rarely the component that broke."

Which is the one thing worth taking away from this page. When something will not start, do not start fixing. Get the error number, find out what is underneath it, and you will usually discover the repair is small and the diagnosis was the whole job.

Revision note. Originally published 8 December 2016, updated in November 2021, and rewritten on 9 August 2026. The original three methods — run the system file checker, start the service by hand in services.msc, or start it with Start-Service MpsSvc in PowerShell — all still work today, and the PowerShell commands are unchanged after a decade. What that version could not tell you is the thing that turns out to matter most: which of those methods to use, because the error number decides it, and using the wrong one costs an evening. So this rewrite is built around the numbers, adds the full three-service dependency chain read off a current Windows 11 machine, and is deliberately blunt about the popular registry advice that widens permissions on a security component and never mentions putting them back. If you are staring at a machine with the firewall off and a quote for a reinstall in your hand, try the section matching your error number first — more often than not it is a four-click fix, and you have not broken anything. If your error number is not one of the four here, send it to us through the contact page and we will add it.