Fix Firewall Rule Compilation Failure 0x80070422

You see this error when Windows Firewall can't apply a new rule set. Usually after a 3rd-party security tool uninstall or a Windows update. The fix is restoring the service startup type.

You're sitting at your desk, you just installed a new VPN client or uninstalled an old antivirus like Norton or McAfee. Then you try to turn on Windows Defender Firewall from the control panel. Or you run a netsh advfirewall command. And boom — you get error 0x80070422. The message says something like "The service cannot be started" or "Firewall rule set compilation failed." It's frustrating because the firewall looks like it's off, and you can't turn it back on.

I've seen this happen most often after someone removes a third-party security suite (like Norton, McAfee, or Trend Micro) that didn't clean up after itself. Or after a Windows update that changed service startup types. Less common — a group policy from an IT department that locks things down. But for home users, it's almost always a service that's stuck on "Disabled" when it should be "Automatic."

Root Cause — It's Almost Always the Base Filtering Engine

The Windows Firewall doesn't run by itself. It depends on a service called Base Filtering Engine (BFE). If that service is stopped or disabled, the firewall can't compile any rule sets. It just sits there, confused, and throws that error.

Here's what happens step by step: when you try to apply a firewall rule, Windows asks BFE to load the rule policy. BFE talks to the Windows Firewall service. If BFE isn't running, the whole chain breaks. No rules get applied. You get error 0x80070422.

The fix is straightforward. You need to set the BFE service to start automatically, start it, and then reset the firewall policy to make sure everything is clean. I'll walk you through it.

Fix — Step by Step

Open Services Manager. Press Windows Key + R, type services.msc, and hit Enter. You'll see a list of all services on your computer. Wait for it to load completely — it can take a few seconds on older machines.
Find the Base Filtering Engine. Scroll down until you see Base Filtering Engine. It's under the "B" section. Double-click it.
Check the Startup type. In the window that opens, look at the "Startup type" dropdown. If it says Disabled, that's the problem. Change it to Automatic. If it's already on Automatic, then the service is probably stopped. That's fixable too.
Start the service. Click the Start button. Wait a few seconds. You should see the service status change to "Running." If it starts without error, great. If you get an error like "Access Denied" or "The service did not respond," that's a different problem — see the troubleshooting section below.
Apply and close. Click Apply, then OK. Close the Services window.
Reset the firewall policy. This step clears any corrupted rule sets. Open a Command Prompt as Administrator. Click Start, type cmd, right-click "Command Prompt," and choose "Run as administrator." Then type this command and press Enter:
```
netsh advfirewall reset
```
You should see a message: "Ok." That means the firewall rules have been reset to default.
Restart the Windows Firewall service. In the same Command Prompt, type:
```
net start MpsSvc
```
If the firewall is already running, you'll get a message saying "The requested service has already been started." That's fine. If it starts, you're good.
Test the firewall. Open Windows Security (Windows Defender). Go to "Firewall & network protection." Check that your network profile (Domain, Private, Public) shows the firewall as "On." Try turning it off and back on — it should work without the error.

What to Check If It Still Fails

Sometimes the fix above doesn't work. Here's what else I check:

Group Policy is overriding settings. If you're on a work laptop, your IT department might have set a policy that disables the firewall. Open a Command Prompt as Admin and type gpresult /h gp.html. Then open that file in your browser. Look under "Computer Configuration\Administrative Templates\Network\Network Connections\Windows Defender Firewall" for any policy that says "Disabled" or "Not configured." If a policy is forcing it off, you can't fix it yourself. Talk to your IT admin.
Corrupted registry keys. I've seen cases where the BFE service registry key gets damaged. Open Registry Editor (regedit), go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE. Check the Start value. It should be 2 (Automatic). If it's 4 (Disabled), change it to 2. Close regedit and reboot.
Third-party firewall still installed. If you uninstalled Norton or McAfee but left some components behind, Windows Firewall won't turn on. Use the vendor's removal tool (like Norton Remove and Reinstall Tool or McAfee Consumer Product Removal Tool) to clean up leftovers. Then try the steps above again.
System file corruption. Run a System File Checker scan. Open Command Prompt as Admin, type sfc /scannow, and let it run. It takes 15-20 minutes. If it finds corrupt files and fixes them, try the firewall again.

If none of that works, you might be dealing with a deeper issue like a malware infection that disabled the firewall. Run a full scan with Windows Defender Offline or Malwarebytes. That usually catches stuff that disables security services.

The good news is that 95% of the time, it's just the Base Filtering Engine being disabled. Set it back to Automatic, reset the firewall, and you're done. No need to reinstall Windows or buy new software.