Microsoft-Windows-Windows Firewall with Advanced Security/Operational - Event ID

Firewall Policy Deployment Incomplete: Quick Fix

Cybersecurity & Malware Intermediate 👁 8 views 📅 Jun 25, 2026

Your firewall policy changes aren't applying. It's usually a group policy conflict or stuck service. Here's how to fix it.

Quick answer

Open Command Prompt as Admin and run: net stop mpssvc && net start mpssvc then gpupdate /force. That fixes it 80% of the time.

Why this happens

This error usually pops up on Windows 10 or 11 domain-joined machines. You make a change to the firewall policy via Group Policy Management Console, run gpupdate, and get "Firewall Policy Deployment Incomplete" with Event ID 2004 in the event log. The firewall rules don't show up. It's because the Windows Firewall service (mpssvc) didn't pick up the policy update properly. This tripped me up the first time too. I've seen it most often on systems that were just joined to the domain or after a quick restart the night before.

Numbered fix steps

  1. Check the event log
    Open Event Viewer, go to Applications and Services Logs/Microsoft/Windows/Windows Firewall with Advanced Security/Operational. Look for Event ID 2004. That's your confirmation.
  2. Restart the Windows Firewall service
    Press Win+R, type services.msc, find "Windows Defender Firewall" (or "Windows Firewall" on older versions). Right-click, select Restart. Or use the command from the Quick answer: net stop mpssvc && net start mpssvc.
  3. Force a group policy update
    Open Command Prompt as Admin. Type gpupdate /force. Wait for it to finish. This forces the machine to re-download and apply all policies, including firewall rules.
  4. Verify the policy applied
    Open wf.msc (Windows Firewall with Advanced Security). Check the Inbound and Outbound rules. Your new policy rules should appear now. If not, re-run gpupdate /force after restarting the service again.
  5. Reboot if it's still stuck
    Sometimes the service needs a clean start. Reboot the machine, then run gpupdate /force once logged in.

Alternative fixes if the main one fails

If restarting the service and gpupdate doesn't work, try these:

  • Restart the Network Location Awareness service (nlasvc). This service talks to the firewall. Open Services.msc, find "Network Location Awareness", restart it. Then restart the firewall service again.
  • Check for conflicting local rules. Sometimes a local rule that you set manually blocks the group policy rule. Open wf.msc, go to the rule list, and delete any duplicate or conflicting rules. Then run gpupdate /force one more time.
  • Use the Group Policy Management Console to re-apply. On the domain controller, right-click the policy, select "Enforce" then "Disable" then "Enable" again. This forces a version change.
  • Check DNS. If the machine can't find the domain controller, it can't download the policy. Run nslookup to verify. If it fails, flush DNS with ipconfig /flushdns and try gpupdate again.

Prevention tip

This is the big one: after making any firewall policy change in Group Policy, always run gpupdate /force on a test machine first. If it works, apply to the rest. Also, set the firewall service to "Automatic" and not "Automatic (Delayed Start)". The delayed start can cause this exact issue because the policy applies before the service is ready.

I've seen this error on Windows 10 20H2 and Windows 11 22H2 a lot. The real fix is always restarting the firewall service before the update. Don't skip it.

Was this solution helpful?

firewall policy deployment incomplete windows firewall group policy stuck firewall policy not applying event id 2004 fix firewall deployment error gpupdate firewall firewall service restart windows defender firewall policy group policy update firewall firewall changes not taking effect nlasvc firewall policy mpsdrv firewall error windows 10 firewall policy stuck windows 11 firewall policy not working