Jason Ross

I was recently repairing a customers computer and noticed that their Windows Firewall was turned off. Windows was freaking out that the firewall was off and it was displaying it’s pop-up messages in the lower right hand corner of the screen. I clicked on the balloon message to turn on the firewall but I got a message saying that it could not start. I went into the services to try and manually turn on the firewall. I noticed that the firewall was set turn automatically run when the computer is turned on but the firewall was not started. I tried to manually start the firewall but I got an error saying something like this:

Windows could not start the Windows Firewall on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 5.

Checking the event log I also got a message something like this:

Source: Service Control manager Eventlog Provider.
Event ID: 7024
The Windows Firewall service terminated with service-specific error 5 (0×5)

The error code 5 has something to do with permissions. Doing some research I figured out how to fix this issue. I was able to go into the registry and set the correct permissions. When you are done, you will be able to start the Windows Firewall.

Solution:

Go into the registry editor and browse to the following keys. You will need to set the permissions for the following account NT Service\MpsSvc. The correct value is below the location path.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch

Query Value;Set Value

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

Full Control;Read

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy

Full Control;Read
For the DHCP Client service, the issue may occur if the “NT Service\DHCP” account does not have the necessary permissions for the following keys:

Registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
permission needed: Query value, Create value, Enumerate Subkeys, Notify, Read Control

Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Configurations
permission needed: Full Control, Read

For the “Diagnostic Policy Service” service, the issue may occur when the account Trustedinstaller is missing the permissions for the key below:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DPS\Parameters

permission needed: Full Control, Read

Source: http://support.microsoft.com/kb/943996