Windows Firewall Error 0x800706D9 “The snap-in failed to load”

When you open the Windows Firewall (with Advanced Security) applet, the following error may show up:

There was an error opening the Windows Defender Firewall with Advanced Security snap-in

The Windows Defender Firewall with Advanced Security snap-in failed to load. Restart the Windows Defender Firewall service on the computer that you are managing. Error code: 0x6D9.

The Win32 error code 0x6D9 (“0x800706D9” or EPT_S_NOT_REGISTERED) means “There are no more endpoints available from the endpoint mapper.”

Attempting to start the Windows Firewall service (“mpssvc“) may show that the service gets stuck in the “Start Pending” state. Or, the service may throw the following error:

Windows could not start the Windows Defender Firewall service on Local Computer. 
The service did not return an error. This could be an internal Windows error or an internal service error.
If the problem persists, contact your system administrator.

Also, the Windows Security UI may show the following error:

Microsoft Defender Firewall is using settings that may make your device unsafe.

Restoring default settings will remove all Windows Defender Firewall settings that you have configured for all network locations. This might cause some apps to stop working.

The classic Control Panel may show the following error:

Update your Firewall settings

Windows Defender Firewall is not using the recommended settings to protect your computer.

However, clicking on the “Restore settings”, “Use recommended settings”, or restoring default settings by resetting the Windows Firewall using any other method may not help.

CAUSE

The Windows Firewall error 0x6D9 may occur if one or both of the following service registry keys are corrupted, or their permissions are incorrect.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfe

The mpssvc service (NT Service\mpssvc) must have write access to the following keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2

and mpssvc must have special permissions (or Full control permissions) for the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

These are the special permissions assigned for mpssvc by default.

RESOLUTION

To resolve the issue, follow these steps to replace the SharedAccess, BFE, and MpsSvc registry keys from another computer. The following steps should restore the missing keys/values and fix the incorrect registry permissions automatically.

1. In the C:\ drive, create a folder named “Registry” — C:\Registry.
2. Download firewall_fix_windows_10.zip or firewall_fix_windows_11.zip
3. Extract the four files from the Zip file to C:\Registry.
4. From the C:\Registry folder, right-click “Run.bat” and choose “Run as administrator.”
   
   (Note: You should see the output “The operation completed successfully” for each command.)
   
5. Restart Windows.

The Base Filtering Service, Internet Connection Sharing (ICS), and Windows Firewall services should now be fixed.