Windows Event ID 5025 – Windows Firewall: Service Failed to Start

Start by examining the Windows Firewall service and its dependencies to identify immediate issues.

Step 1: Open an elevated PowerShell session and check service status:

Get-Service -Name MpsSvc, BFE, Dnscache, RpcSs | Select-Object Name, Status, StartType

Step 2: Review the specific error details in Event Viewer:

Navigate to Event Viewer → Windows Logs → System and filter for Event ID 5025. Note the error code and description.

Step 3: Check dependent services that must be running:

$dependencies = @('BFE', 'RpcSs', 'Dnscache')
foreach ($service in $dependencies) {
    $svc = Get-Service -Name $service
    if ($svc.Status -ne 'Running') {
        Write-Host "$service is $($svc.Status) - attempting to start" -ForegroundColor Yellow
        Start-Service -Name $service
    }
}

Step 4: Attempt to start the Windows Firewall service:

Start-Service -Name MpsSvc -Verbose

If this method succeeds, monitor the system for 24 hours to ensure the service remains stable.

Reset the Windows Firewall to default settings to resolve configuration corruption issues.

Step 1: Stop the Windows Firewall service if it's running:

Stop-Service -Name MpsSvc -Force

Step 2: Reset firewall settings to defaults using netsh:

netsh advfirewall reset

Step 3: Clear the Windows Filtering Platform (WFP) state:

netsh wfp set options netevents=on
netsh wfp show state

Step 4: Reset network security policies:

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

Step 5: Restart the Base Filtering Engine and Windows Firewall services:

Restart-Service -Name BFE -Force
Start-Service -Name MpsSvc

Manually repair corrupted registry entries that prevent the Windows Firewall service from starting.

Step 1: Create a registry backup before making changes:

reg export "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" C:\Temp\MpsSvc_backup.reg

Step 2: Check the service registry key for corruption:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\MpsSvc" | Format-List

Step 3: Verify the ImagePath value points to the correct svchost.exe group:

$imagePath = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\MpsSvc" -Name "ImagePath"
if ($imagePath.ImagePath -ne "%SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork") {
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\MpsSvc" -Name "ImagePath" -Value "%SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork"
}

Step 4: Reset service permissions using sc.exe:

sc.exe sdset MpsSvc "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)"

Step 5: Rebuild service dependencies:

sc.exe config MpsSvc depend= BFE/RpcSs

Step 6: Test service startup:

Start-Service -Name MpsSvc -ErrorAction Stop

Use Windows built-in repair tools to fix corrupted system files affecting the firewall service.

Step 1: Run DISM to repair the Windows component store:

DISM /Online /Cleanup-Image /RestoreHealth

Step 2: Execute System File Checker to repair corrupted files:

sfc /scannow

Step 3: Check CBS.log for specific firewall-related repairs:

Select-String -Path "C:\Windows\Logs\CBS\CBS.log" -Pattern "MpsSvc|BFE|firewall" | Select-Object -Last 20

Step 4: Reset Windows Update components if firewall issues stem from failed updates:

Stop-Service -Name wuauserv, cryptSvc, bits, msiserver -Force
Rename-Item -Path "C:\Windows\SoftwareDistribution" -NewName "SoftwareDistribution.old" -Force
Rename-Item -Path "C:\Windows\System32\catroot2" -NewName "catroot2.old" -Force
Start-Service -Name wuauserv, cryptSvc, bits, msiserver

Step 5: Re-register firewall-related DLL files:

$dlls = @('firewallapi.dll', 'hnetcfg.dll', 'fwpuclnt.dll')
foreach ($dll in $dlls) {
    regsvr32 /s $dll
}

Step 6: Restart the system and verify service startup:

Restart-Computer -Force

Perform a complete Windows Filtering Platform database rebuild for persistent issues.

Step 1: Boot into Safe Mode to prevent service conflicts during repair.

Step 2: Stop all network-related services:

$services = @('MpsSvc', 'BFE', 'Dnscache', 'NlaSvc', 'Dhcp')
foreach ($service in $services) {
    Stop-Service -Name $service -Force -ErrorAction SilentlyContinue
}

Step 3: Delete corrupted WFP database files:

Remove-Item -Path "C:\Windows\System32\config\BCD-Template" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "C:\Windows\System32\wfp\*" -Recurse -Force -ErrorAction SilentlyContinue

Step 4: Reset the entire network stack:

netsh int ip reset
netsh winsock reset
netsh advfirewall reset

Step 5: Rebuild network adapter bindings:

Get-NetAdapter | Reset-NetAdapterAdvancedProperty
Restart-NetAdapter -Name "*"

Step 6: Re-initialize the Base Filtering Engine:

Start-Service -Name BFE
Start-Sleep -Seconds 10
Start-Service -Name MpsSvc