Blog Post: Certain Administrative Templates from the Windows XP Security Guide may prevent you from starting the Windows Firewall service in Windows XP Service Pack 2

KB Article: http://support.microsoft.com/kb/892199

 

INTRODUCTION

After you install Windows XP Service Pack 2 (SP2), you cannot start the Windows Firewall service. You may experience one or more of the following symptoms:

·         When you click Windows Firewall in Control Panel, you may receive the following error message:

Windows Firewall settings cannot be displayed because the associated service is not running. Do you want to start the Windows Firewall/Internet Connection Sharing (ICS) service?

If you click Yes, you receive the following error message:

Windows cannot start the Windows Firewall/Internet Connection Sharing (ICS) service.

·         If you try to manually start the Windows Firewall service by using Services, you may receive the following error message:

Could not start the Windows Firewall/Internet Connection Sharing (ICS) service on Local Computer.
Error 0x80004015: The class is configured to run as a security id different from the caller

Note To open Services, click Start, click Control Panel, double-click Administrative Tools, and then double-click Services. For information about how to use Services, on the Action menu in Services, click Help.

·         The following events may appear in the system event log:

Event ID: 7036
Event Source: Service Control Manager
Event Type: Information
Event Category: None
Description:
The Windows Firewall/Internet Connection Sharing (ICS) service entered the stopped state.

Event ID: 7023
Source: Service Control Manager
Type: Error
Description:
The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error:
The class is configured to run as a security id different from the caller

·         When you use the SC query command to determine the status for the Windows Firewall/Internet Connection Sharing service, you see the following output:

C:\>sc query sharedaccess

SERVICE_NAME: sharedaccess

TYPE : 20 WIN32_SHARE_PROCESS

STATE : 1 STOPPED

(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)

WIN32_EXIT_CODE : -2147467243 (0x80004015)

SERVICE_EXIT_CODE : 0 (0x0)

CHECKPOINT : 0x0

WAIT_HINT : 0x0

·         If you try to start the Windows Firewall/Internet Connection Sharing (ICS) service at the command prompt by using the net start sharedaccess command, you see the following output:

C:\>net start sharedaccess

The Windows Firewall/Internet Connection Sharing (ICS) service is starting.

The Windows Firewall/Internet Connection Sharing (ICS) service could not be started. 

A system error has occurred.

System error 16405 has occurred.

The system cannot find message text for message number 0x4015 in the message file for BASE.

Note The Windows Firewall feature of Windows XP SP2 is a replacement for the Internet Connection Firewall (ICF) in earlier versions of Windows XP.

Radha Mitchell Melissa Rycroft Chloë Sevigny Janet Jackson Georgianna Robertson