How to Fix Base Filtering Engine Service Startup Problems

The Base Filtering Engine (BFE) service is a crucial network component targeted by malware. If the BFE service doesn’t start, many services, such as Windows Firewall, Routing, Remote Access, and others, fail to start.

If the BFE service is missing from the Services MMC or the Action Center warns you that the Windows Firewall isn’t enabled, your system is likely under malware attack. Have it checked thoroughly using a reputed anti-malware tool, or you may seek professional help to eliminate malware. Trying to repair these services when malware is on board your system isn’t going to help.

This post assumes that you’ve done a malware cleanup and want to know how to fix the BFE and Windows Firewall services.

The first (and probably the only) thing most of us do to reinstate the Base Filtering Engine Service is to import the service registry keys from a similar computer, which is a correct step. But this only enlists the service in the Services MMC, but the required service Permissions aren’t assigned automatically. Due to missing special permissions for the BFE service, the following errors occur when you try to turn on the BFE or Windows Firewall.

Action Center can’t turn on Windows Firewall

Turning it on via the Windows Firewall applet may show the error Windows Firewall can’t change some of your settings. Error code 0x80070433 or 0x8007042c.

Services MMC: Windows could not start the Windows Firewall service on Local Computer. Error 1075: The dependency service does not exist or has been marked for deletion.

Services MMC: Windows could not start the Base Filtering Engine service on Local Computer. Error 5: Access is denied.

This is recorded in the System event log as well:

Log Name: System
Source: Service Control Manager
Date: 1/9/2020 8:21:25 AM
Event ID: 7023
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: W10-PC
Description:
The BFE service terminated with the following error:
Access is denied.
RELATED: Windows Firewall Error 0x6d9 “The snap-in failed to load”

Resolution: Repair Base Filtering Engine

Step 1: Import the BFE Service Registry Keys

  1. First, create a Restore Point.
  2. Download AdvancedRun from Nirsoft.net.
  3. Using AdvancedRun, launch C:\Windows\Regedit.exe under the TrustedInstaller privileges.(For more info, see How to Run programs as TrustedInstaller.)

    Launch regedit.exe as TrustedInstaller using AdvancedRun (nirsoft.net)

  4. After starting the Registry Editor as TrustedInstaller, you may close the AdvancedRun utility.
  5. Download the BFE service registry fix below for your version of Windows: 
    BFE for Windows 7 | BFE for Windows 8 | BFE for Windows 10 | BFE for Windows 11
  6. Unzip the archive and extract the .reg file to a folder — e.g., “C:\Temp”
  7. From the Registry Editor, click File, Import…, select the BFE registry file, and import it.
    BFE service registry fix import

This adds the BFE service to the registry.

Don’t close the Registry Editor yet. The next step is to fix the BFE service registry key permissions. See “Step 2” below.

Step 2: Fix the BFE service registry permissions

  1. In the Registry Editor (run as TrustedInstaller) window, and go to the following branch: 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy
  2. Right-click Policy, and click Permissions
    BFE service permissions fix
    It has some default permissions inherited from the parent key. By default, the SYSTEM and Administrators groups have full control permission for the branch. But this isn’t enough to start BFE.
  3. Click on the Add button.
    BFE service permissions fix
  4. In the Enter the object names to select: box, type NT SERVICE\BFE, and click OK.
    BFE service permissions fix - NTService\BFE
  5. BFE is added to the list of Group or user names. We need to give it special permissions. Click Advanced
    BFE service permissions fix
  6. Select BFE, and click the Edit button.
    BFE service permissions fix
  7. In the Permission Entry dialog, click “Show advanced permissions.”
    BFE service permissions fix - Special permissions
  8. Enable the following Permissions:BFE service permissions fix - Special permissions
    • Query Value
    • Set Value
    • Create Subkey
    • Enumerate Subkeys
    • Notify
    • Read Control (this is added by default when you added BFE)
  9. After adding the above six special permissions, click OK.
  10. You’ll be back at the Advanced Security Settings dialog now. Click Replace all child object permissions with inheritable permissions from this object, and click OK.
    BFE service permissions fix
  11. You’ll be back at the standard permissions dialog. Click OK and close the dialog.
    BFE service permissions fix
  12. Exit the Registry Editor.
  13. Restart Windows, and then launch the Services MMC (services.msc)
  14. Double-click Base Filtering Engine and check its status. If the permissions are correct and no malware is on board, the Base Filtering Engine service should show the status Running.
    BFE service permissions fix - Services MMC
RELATED: Fix for Base Filtering Engine (BFE) Service Error 1083

Step 3: Check the Security Descriptors

Still no dice..? If the above steps fail to resolve the issue, resetting the BFE service permissions or security descriptors should do the trick.

  1. Open an elevated or admin Command Prompt.
  2. Type in the following command: 
    [Windows 7 and Windows 8]
SC.EXE SDSET BFE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

[Windows 10]
SC.EXE SDSET BFE D:(A;;CCLCLORC;;;AU)(A;;CCDCLCSWRPLORCWDWO;;;SY)(A;;CCLCSWRPLORCWDWO;;;BA)(A;;CCLCLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD)

[Windows 11]
SC.EXE SDSET BFE D:(A;;CCLCLORC;;;AU)(A;;CCDCLCSWRPLORCWDWO;;;SY)(A;;CCLCSWRPLORCWDWO;;;BA)(A;;CCLCLO;;;BU)

    Make sure there are no spaces in the Security Descriptor string. It should be like this:

    SC <SPACE> SDSET <SPACE> <SECURITYDESCRIPTOR>

RELATED: Check out this article for background information on service Security Descriptors (SDDL).

And you should see the message SetServiceObjectSecurity SUCCESS. Restart Windows once again.

Editor’s note

If you get the error SetServiceObjectSecurity FAILED 5: Access is denied when running the SC.EXE SDSET command mentioned above, then the registry key permissions or the service permissions are wrong somewhere. In that case, re-run all of the above steps to verify the permission entries. It should eventually work!

One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

...

24 thoughts on “How to Fix Base Filtering Engine Service Startup Problems”

  3. should read:
    SC SDSET BFE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

    Reply

  5. This one helped me, while somehow auslogicsboostspeed and ccleaner ____Up my system.
    The thing now is i cant delete BFE on Security Group or User Names on registry because before there was not there…

    Reply

  6. I ran the registry program listed here, and it changed my error reading to a 1083, the solution on this website to which doesn’t work

    Reply

  8. I am running windows programs on Ubuntu using Wine. When I try to run them, it shous the error “Base Filtering Engine Windows Service is missing”.
    Can anyone please suggest me the trouble shooting steps?
    The OS I’m using currently on my laptop is Ubuntu.

    Reply

  10. i have been search and do some tutorial in another site, all cant work. and this one amazingly WORK
    Thank you!!

    Reply

  11. drive.google.com/file/d/13dqCO7iR8uED3GHRhFFAIgPEUsflxnvW/view?usp=sharing
    use this tool (Tweaking.com-RepairWindowsFirewall.exe) to fix

    Reply

  12. Hello I’m dutch and a noob with computers. So sorry about my bad English. BFE is not running (it says automatic) and i can’t solve the problem. It’s Windows 10 home and when I try step 3 I get this:
    At line:1 char:18
    + SC SDSET BFE D:(A;;CCLCLORC;;;AU)(A;;CCDCLCSWRPLORCWDWO;;;SY)(A;;CCLC …
    + ~
    Missing closing ‘)’ in expression.
    At line:1 char:33
    + SC SDSET BFE D:(A;;CCLCLORC;;;AU)(A;;CCDCLCSWRPLORCWDWO;;;SY)(A;;CCLC …
    + ~
    Unexpected token ‘)’ in expression or statement.
    At line:1 char:36
    + SC SDSET BFE D:(A;;CCLCLORC;;;AU)(A;;CCDCLCSWRPLORCWDWO;;;SY)(A;;CCLC …
    + ~
    Missing closing ‘)’ in expression.
    At line:1 char:61
    + SC SDSET BFE D:(A;;CCLCLORC;;;AU)(A;;CCDCLCSWRPLORCWDWO;;;SY)(A;;CCLC …
    + ~
    Unexpected token ‘)’ in expression or statement.
    At line:1 char:64
    + … SDSET BFE D:(A;;CCLCLORC;;;AU)(A;;CCDCLCSWRPLORCWDWO;;;SY)(A;;CCLCSW …
    + ~
    Missing closing ‘)’ in expression.
    At line:1 char:87
    + … C;;;AU)(A;;CCDCLCSWRPLORCWDWO;;;SY)(A;;CCLCSWRPLORCWDWO;;;BA)(A;;CCLC …
    + ~
    Unexpected token ‘)’ in expression or statement.
    At line:1 char:90
    + … ;;AU)(A;;CCDCLCSWRPLORCWDWO;;;SY)(A;;CCLCSWRPLORCWDWO;;;BA)(A;;CCLCLO …
    + ~
    Missing closing ‘)’ in expression.
    At line:1 char:103
    + … CSWRPLORCWDWO;;;SY)(A;;CCLCSWRPLORCWDWO;;;BA)(A;;CCLCLO;;;BU)S:(AU;FA …
    + ~
    Unexpected token ‘)’ in expression or statement.
    At line:1 char:109
    + … LORCWDWO;;;SY)(A;;CCLCSWRPLORCWDWO;;;BA)(A;;CCLCLO;;;BU)S:(AU;FA;CCDC …
    + ~
    Missing closing ‘)’ in expression.
    At line:1 char:142
    + … LORCWDWO;;;BA)(A;;CCLCLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD)
    + ~
    Unexpected token ‘)’ in expression or statement.
    + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : MissingEndParenthesisInExpression

    And I am sure that I didn’t make a mistake by typing.
    Can b
    somebody tell me what I am doing wrong?

    Reply

  16. after doing the steps bfe service is now running in my computer but my windows defender fire wall is switching between starting and running and i can’t change it help please

    Reply

  19. Thanks you very much !! It worked for me too 🙂

    P.S.: Like others users, I have been search and do some tutorials in anothers sites, all can’t work. and this one amazingly WORK !

    Reply

Leave a Comment