Windows Defender Firewall Error 0x800706d9: Fix "Can't Change Some of Your Settings"
If Windows Defender Firewall throws error code 0x800706d9 the moment you click "Use recommended settings," the fastest fix is to restart three background services in this order — the RPC Endpoint Mapper, the Remote Procedure Call service, and the Windows Firewall service itself — because that's what's actually broken, not your firewall configuration. Here's the part almost nobody tells you: this isn't really a firewall error at all. It's the generic Windows error for "a background service my request depended on wasn't there to answer," and Windows recycles that same code for failed Store downloads and failed updates for the identical reason.
That reframe matters because it changes where you should be looking. You don't need to reinstall Windows, run a virus scan first, or fight with firewall rules one by one. You need to get three small, boring services back to "Running," and in most cases that's a five-minute job.
Jake hit this one on a Tuesday, which is never the day you want it. A customer had dropped off a laptop that needed a specific port opened so a diagnostic tool could talk to Jake's bench PC over the shop's network — a five-minute job he'd done a dozen times. He clicked into Windows Security, went to add the exception, and got Windows Defender Firewall can't change some of your settings. Error code 0x800706d9 instead. No exception, no diagnostic run, and a customer standing at the counter checking the time.
"I figured I'd nuked something," Jake said afterward. "Like I'd have to reinstall Windows over a firewall setting." Ethan's answer, when he called: "You didn't break anything. A service just isn't running, and Windows is being unusually honest about which one it needs and can't reach. That's actually the easy version of this problem." The fix took less time than the diagnostic tool would have taken to run.
What 0x800706d9 Actually Means
Under the hood, 0x800706d9 translates to a Windows system error called EPT_S_NOT_REGISTERED. In plain terms: one program tried to ask another program a question over Windows' internal messaging system (called RPC, short for Remote Procedure Call), and there was nobody home to answer. The Windows Defender Firewall settings panel isn't a single self-contained program — when you click "Use recommended settings" or "Restore defaults," it's actually sending that request to a background service, and if the services it depends on aren't running, the request bounces back as 0x800706d9.
The services involved are the RPC Endpoint Mapper (RpcEptMapper), the core Remote Procedure Call service (RpcSs), and the Windows Firewall service itself, which runs under the internal name MpsSvc. If any one of those three is stopped, disabled, or blocked from starting, the firewall panel can't finish the change you asked for and hands you this code instead. This is documented behavior — Microsoft's own troubleshooting notes for this exact error code confirm the cause is one of these dependent services being unavailable, and list a corrupted firewall registry configuration or a Group Policy setting as the two other possibilities.
🙋♂️ Jake's Reality Check
"Wait, so my firewall isn't actually broken? Then why does it say Firewall right there in the error?"
Because the message is about what you were trying to change, not what's actually wrong. The firewall panel is the messenger. The services underneath it are what stopped.
What Actually Causes This Error
Every one of these leads back to the same place — a service the firewall panel needs isn't running. The table below lists them from most to least common, so start at the top.
| Cause | What's happening | Where to look |
|---|---|---|
| RPC services stopped | RpcEptMapper or RpcSs isn't running | Restart services |
| Firewall service stopped | MpsSvc (Windows Defender Firewall) is stopped or disabled | Restart services |
| BFE not running | The Base Filtering Engine, which the firewall depends on, has stopped | Check BFE |
| Corrupted firewall registry | The FirewallPolicy registry key is missing or damaged | Reset configuration |
| Third-party security software | Another firewall or antivirus disabled MpsSvc when it installed | Check installed security apps |
| Group Policy or MDM lock | A managed device policy disabled the firewall service centrally | Check policy |
Fix It on Windows 11
These steps go from cheapest to most involved. Do them in order and stop as soon as the error stops appearing.
- Open Command Prompt as administrator. Right-click the Start button, or press Win + X, and choose Terminal (Admin) or Command Prompt (Admin). This step matters — none of the following commands will apply without administrator rights, and Windows will simply say "Access is denied" if you skip it.
- Set the RPC Endpoint Mapper and RPC service to start automatically, then start them. Run these one at a time:
sc config RpcEptMapper start= autosc start RpcEptMappersc config RpcSs start= autosc start RpcSs
The space after the equals sign instart=is not a typo — that command fails silently without it. - Set the Windows Firewall service to automatic and start it.
sc config MpsSvc start= autosc start MpsSvc
If this command returns "the dependency service or group failed to start," the Base Filtering Engine is the actual blocker — skip ahead to that section rather than repeating this step. - Restart the PC. Service changes made this way generally take hold immediately, but a restart clears anything that was mid-failure when you started, and it's the honest way to confirm the fix held rather than just looking like it did.
- Retry the setting that failed. Open Windows Security > Firewall & network protection, and click "Use recommended settings" (or whatever you were changing) again. If it goes through cleanly, you're done.
Ethan's take, when Jake asked why this wasn't just one button: "Because Microsoft would rather you fix the actual service than mask the symptom. A one-click fix that hides a stopped service is the kind of thing that comes back in three weeks — usually right when a customer's standing at the counter again."
Check the Base Filtering Engine Service
The Base Filtering Engine, service name BFE, is the piece of Windows that manages firewall and IPsec filtering policy underneath everything you see in the Firewall panel. Windows Defender Firewall depends on it directly — if BFE isn't running, MpsSvc can't start either, and you'll get 0x800706d9 no matter how many times you restart the firewall service on its own.
To check it: press Win + R, type services.msc, press Enter. That opens the Services console — a list of every background program Windows runs whether or not anything is open on your screen. Scroll to Base Filtering Engine. If its status column doesn't say "Running," right-click it and choose Start. If Start is grayed out or the service refuses to start, right-click it, choose Properties, and confirm the Startup type is set to Automatic rather than Disabled — a disabled BFE is the single most common reason the firewall service can't even attempt to start.
Reset the Firewall Configuration
If restarting the services didn't clear the error, the next likely cause is a damaged firewall registry configuration. You can check it directly. In an administrator Command Prompt, run:
reg query "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy" /s
If that key is missing or the command returns an error instead of a list of settings, the fix is to reset the firewall to its factory configuration:
netsh advfirewall reset
⚠️ What this actually breaks
This command wipes every custom firewall rule you or an app has ever created — port exceptions for a game server, an app you allowed through manually, a VPN rule, all of it — and puts the firewall back to Windows' out-of-the-box defaults. It does not touch your files, and most apps that need a firewall exception will silently re-request one the next time they need it. But if you've hand-built specific rules, note them down first, because there's no undo for this one.
Windows 11 UI Traps While You're In There
Two things trip people up on Windows 11 specifically. First, "Windows Firewall" as a standalone control panel item barely exists anymore — you'll mostly land in the Windows Security app, under Firewall & network protection, which has an option to "Restore firewalls to default" right there if you'd rather click than type commands. Second, if you go looking for the old-style Windows Firewall with Advanced Security console to inspect rules manually, it's still there — search for wf.msc — but the entry point from Control Panel is easy to lose among the redesigned Settings pages. If a support article tells you to open "Control Panel > Windows Defender Firewall" and you can't find it, searching wf.msc directly from Start gets you to the same place faster.
Fix It on Windows 10
The services and commands are identical on Windows 10 — this is one of the cases where the fix genuinely doesn't care which version you're on, because RPC, BFE, and the firewall service have worked the same way for years. The steps:
- Open Command Prompt as administrator. Right-click Start > Command Prompt (Admin), or Windows PowerShell (Admin) on newer builds.
- Restart the same three services, in the same order as the Windows 11 steps above: RpcEptMapper, then RpcSs, then MpsSvc, setting each to automatic start first.
- Check the Base Filtering Engine via
services.mscif the firewall service still won't start — same process as above. - Reset the firewall configuration with
netsh advfirewall resetif the registry key check comes back empty or broken. - Restart and retest from the classic Control Panel > System and Security > Windows Defender Firewall.
⚠️ One honest note for Windows 10
Windows 10 reached the end of free security support on October 14, 2025. That has no bearing on why this firewall error happens — the cause is the same stopped service either way — but it's a reason to treat a working firewall as more important than ever on an unsupported machine, and a reasonable moment to check whether the PC qualifies for a free Windows 11 upgrade or needs Extended Security Updates instead.
Run the Built-In Firewall Troubleshooter
Microsoft publishes an automated Windows Firewall troubleshooter that checks and repairs the same handful of things covered above — stopped services, a damaged firewall configuration — without you typing a single command. It's a legitimate first or last resort depending on your comfort level with a command line: run it before the manual steps if you'd rather not type commands at all, or after them as a second pass if the manual fix didn't fully stick. It's downloaded and run directly from Microsoft's support site rather than the Microsoft Store.
✅ Why this is the one to try if you're not comfortable with Command Prompt
The troubleshooter checks and restarts the same services this article walks you through by hand, and it's the officially supported path Microsoft points people to for this exact class of firewall error. If you'd rather click "Next" a few times than copy commands, start here instead — just know it can miss a Group Policy-imposed block, which needs the manual check below.
Third-Party Antivirus and Group Policy
If restarting services and resetting the configuration both come back clean, and the error keeps returning, the next two suspects are both things actively holding the firewall service down rather than a one-time glitch.
Third-party security software: some antivirus or third-party firewall products disable MpsSvc on purpose when they install, on the assumption that their own firewall is replacing Windows'. If you've installed or reinstalled a security suite recently, uninstall it fully (not just disable it) through Settings > Apps, restart, and retry the firewall change with only Windows Defender in the picture. If it now works, the other product's uninstaller likely left the service disabled behind it — the steps above will fix that regardless of which product caused it.
Group Policy or device management: on a work, school, or family-managed PC, an administrator can centrally disable the Windows Firewall service through policy, and no amount of restarting it locally will make it stick — the policy simply turns it back off. Run gpresult /r in an administrator Command Prompt and look for any applied policy referencing Windows Defender Firewall. If one shows up and this is a managed device, the fix has to happen at the management console, not on your PC — that's the one thing an individual user genuinely cannot override locally.
Laptops, VPNs, and Remote Desktop: The Edge Cases
A few situations make this error behave slightly differently, and each is worth knowing before you assume the standard fix isn't working.
Laptops that sleep and wake often. On a machine that's constantly going in and out of sleep — the situation for most laptops — a service can occasionally fail to resume cleanly after a wake cycle, even though it shows as "Running." If the fix above works but the error comes back after the laptop's been asleep, a full restart rather than sleep/wake is worth testing once to see if that's the actual pattern, since it points at power settings rather than the services themselves.
VPN connections. A VPN client adds its own virtual network adapter, and Windows Firewall evaluates rules separately for each network profile that adapter creates. If the firewall service itself is down, Windows doesn't gamble on the VPN adapter being safe — it simply can't apply any policy to it, which on some VPN clients shows up as the connection failing silently rather than as 0x800706d9 directly. If a VPN stopped connecting around the same time this error appeared, they're very likely the same root cause, and fixing the firewall service should restore both.
Remote Desktop. Remote Desktop connections depend on a firewall rule being active to accept the incoming connection. If you're trying to remote into this PC and it's refusing connections while also showing 0x800706d9 locally, don't chase Remote Desktop settings first — fix the firewall service, then check whether the Remote Desktop rule needs re-enabling in the (now working) firewall panel.
Multiple user accounts on one PC. These services and registry keys are machine-wide, not per-user. If the error shows up under one account, it will show up under every account on that PC, including a fresh one — so creating a new user account is not a fix here, just a way to confirm the problem isn't tied to one profile.
A Faster Check for Next Time
If you manage more than one PC — Jake's shop runs half a dozen — typing the same five commands on every machine gets old. A single PowerShell command, run as administrator, checks all three services at once without changing anything:
Get-Service RpcEptMapper, RpcSs, MpsSvc, BFE | Select-Object Name, Status, StartType
That prints the current state of all four services in one glance, so you know immediately which one to restart instead of working through the list blind. To restart any that show as Stopped, the equivalent PowerShell command is Start-Service followed by the service name — for example, Start-Service MpsSvc. It does the same job as the sc commands above, just in fewer keystrokes if PowerShell is already your habit.
When Nothing Above Works
This happens rarely, but it happens: a corrupted system file underneath the firewall service that no amount of restarting will fix. Two paths from here, in order:
System file repair. Open an administrator Command Prompt and run DISM /Online /Cleanup-Image /RestoreHealth, let it finish completely (it's normal for it to sit at a percentage for several minutes), then run sfc /scannow. Restart, then retry the firewall change. This repairs damaged system files without touching your documents, photos, or installed apps.
System Restore, if you have a restore point from before the problem started. Search "Create a restore point" from Start, open System Restore, and pick a date before the firewall broke. This rolls back system files and settings — not your personal files — to that earlier state, and it's worth trying if you can pinpoint roughly when this started happening (right after installing a security product, for instance).
If neither works, the last resort is an in-place repair install — reinstalling Windows over itself while keeping your files and apps, which rebuilds every system service including the ones behind this error. It's a genuinely last-resort step: slow, and unnecessary for the overwhelming majority of people who fix this with the service restarts above.
Seeing 0x800706d9 in Microsoft Store or Windows Update Instead?
Same code, same underlying reason, different symptom. This is exactly the reveal from the top of this article: EPT_S_NOT_REGISTERED isn't a firewall-only error, it's what any RPC-dependent Windows feature returns when a service it needs isn't answering. If you're hitting 0x800706d9 while downloading from the Microsoft Store or installing a Windows update rather than in the firewall panel, the fix is the same three services — because Windows Update genuinely depends on the firewall service being available for its own internal communication, even if you never touch firewall settings directly.
| Where you saw 0x800706d9 | What to check first |
|---|---|
| Firewall settings panel | RpcEptMapper, RpcSs, MpsSvc — restart in that order |
| Windows Update install failing | Same three services, plus check the firewall registry key above |
| Microsoft Store download or sign-in | Same three services first; if it persists, re-register the Store app via PowerShell |
Worth knowing if you've recently installed a Patch Tuesday update: a fresh cumulative update occasionally resets a service's startup type back to its default during installation, which is one more reason to check service status after any update, not just after you notice the firewall acting up. If you're not sure whether your Windows 11 PC is even current, that's worth a separate look.
- KB5121003: Windows 11 August 2026 Update and Install Fixes
If a recent update is what triggered your firewall trouble, this covers what that update changed and the fix ladder for when an update itself won't install.
Frequently Asked Questions
What does error code 0x800706d9 mean?
It translates to EPT_S_NOT_REGISTERED, a generic Windows RPC error meaning one service tried to reach another service and got no response, because that service wasn't running.
How do I fix error code 0x800706d9?
Restart the RPC Endpoint Mapper, RPC service, and Windows Firewall service in an administrator Command Prompt, in that order, then restart your PC and retry the setting that failed.
What is 0x800706d9 error on the Microsoft Store?
The same underlying cause as the firewall version — a required background service, usually the Windows Firewall service or an RPC service, isn't running, which blocks the Store from completing its request.
Is error code 0x800706d9 the same on Windows 10 and Windows 11?
Yes. The services involved and the fix are identical on both versions; only the exact menu paths to reach the firewall settings differ.
Why does Windows Defender Firewall say it can't change some of my settings?
Because the settings panel depends on background services to apply changes, and one of those services — most often the Windows Firewall service itself or something it depends on — isn't currently running.
Will resetting the firewall with netsh advfirewall reset delete my rules?
Yes. It removes every custom rule and restores Windows' default firewall configuration. It does not touch your personal files.
What is the Base Filtering Engine and why does it matter here?
BFE is the Windows service that manages the underlying firewall and IPsec filtering rules. The Windows Firewall service cannot start without it, so a stopped BFE will also block firewall settings from changing and can produce this same error.
Can third-party antivirus software cause this error?
Yes. Some antivirus or third-party firewall installers disable the Windows Firewall service on purpose. Uninstalling the third-party product fully, then restarting the Windows Firewall service, typically resolves it.
Can Group Policy cause 0x800706d9?
Yes, on a managed device. A policy that centrally disables the Windows Firewall service will keep re-disabling it even after you restart it locally, and the fix has to be made at the management level, not on the individual PC.
Do I need Command Prompt to fix this, or is there a simpler way?
Microsoft's Windows Firewall troubleshooter, downloaded from its support site, checks and restarts the same services automatically without typing commands. It's a reasonable first step if you'd rather avoid the command line.
What if the services start fine but the error still appears?
Check the firewall registry configuration next, and if that's intact, look at Group Policy and any third-party security software installed. A persistent recurrence after a clean restart usually points to one of those two rather than a one-time service glitch.
Does System Restore fix error 0x800706d9?
It can, if you have a restore point from before the problem started, since it rolls back system files and service configuration to that earlier state. It won't touch your personal files.
Do I need to reinstall Windows to fix this?
Almost never. Reinstalling is a last resort for the rare case where DISM and SFC repairs don't resolve underlying file corruption. Most people fix this by restarting the three dependent services.
Is 0x800706d9 a sign of malware?
Not inherently — it's most often caused by a stopped service, a corrupted firewall configuration, or another security product disabling the firewall service, none of which require malware to be present. It's still worth running a scan if the cause isn't otherwise obvious.
How do I know the fix actually worked?
Reopen Windows Security > Firewall & network protection and repeat the exact action that failed before — clicking "Use recommended settings" or toggling the firewall. No error message means the fix held.
Revision note. Written September 2026, covering Windows 11 (24H2, 25H2) and Windows 10 22H2, including ESU-enrolled devices. This will need a revisit if a future Windows Security app redesign moves the "Restore firewalls to default" option or renames the underlying services..so refer latest details on MS website if not worked or let me know through contact us page, i will check and update; If you're staring at this error at midnight with a form that needs the firewall open to submit — take a breath, work through the list from the top, and you'll very likely have it running again before the kettle's done boiling.