Fix 0XC0220013: Re-enable Network Diagnostic Events

That error code is a pain because it shows up at the worst times — usually when you're running network diagnostics or checking firewall rules, and suddenly Windows tells you it can't collect events. The fix is straightforward, and it doesn't involve registry edits or reinstalling drivers.

The Fix: Turn Event Collection Back On

Open a command prompt as Administrator. Right-click the Start button and pick Command Prompt (Admin) or Windows PowerShell (Admin). On Windows 11, you'll see Terminal (Admin) — that works too.

Copy this command and press Enter:

netsh firewall set opmode enable

Wait a second — you'll see a confirmation that says something like Ok. That's it. No fancy switches, no extra parameters.

Now restart the service that handles diagnostic events so the setting takes effect immediately:

net stop DPS && net start DPS

You'll see The Diagnostic Policy Service service is stopping then The Diagnostic Policy Service service was started successfully. If you get an error about access, double-check you're in the admin prompt — that's the usual culprit.

After that, re-run whatever command gave you the error. The 0XC0220013 message should be gone.

Why This Works

The error code STATUS_FWP_NET_EVENTS_DISABLED comes from the Windows Filtering Platform (WFP). It's a kernel-level component that decides what network traffic gets through the firewall and what gets logged. When you or a third-party security tool turns off the firewall (or event collection) via the netsh firewall interface, WFP stops collecting diagnostic events. It's not a full failure — it's a flag that says "don't bother logging."

Running netsh firewall set opmode enable flips that flag back. That command historically managed the classic firewall state, and even though modern Windows uses netsh advfirewall, the old interface still controls the event collection flag. So when you run it, WFP resumes logging, and the error disappears.

I've seen this happen after running a privacy script or a firewall toggle utility that disables the firewall for a moment and forgets to re-enable it. The script turns off the firewall, but it only disables event collection, not the firewall itself — leaving you with a weird half-on state.

Less Common Variations

Sometimes the simple fix doesn't stick, or the error comes back after a reboot. Here are the variations I've run into over the years.

Variation 1: The Service Won't Start

If net start DPS fails with error 5 (access denied) or error 1058, the Diagnostic Policy Service might be disabled. Open the Services console (press Win + R, type services.msc, hit Enter). Look for Diagnostic Policy Service, right-click it, choose Properties. Set the startup type to Automatic (not Automatic (Delayed Start) — that can cause timing issues), then click Start. After it's running, repeat the netsh command.

Variation 2: The Error Persists After a Reboot

This happens when something else is resetting the flag at boot. A third-party firewall like ZoneAlarm or a parental control app can do that. Boot into Safe Mode (Shift + Restart from the login screen, then troubleshoot options) and run the same netsh firewall set opmode enable command. If it works in Safe Mode but not normally, disable your third-party firewall's self-protection feature temporarily, then re-run the command. That feature often blocks changes to the WFP state.

Variation 3: The Error Happens in a Specific App Only

If you get 0XC0220013 only when running a particular network tool (like some VPN clients), that app might be setting the flag itself. Check the app's settings for anything like "disable event logging" or "stealth mode." Turn that off. If you can't find it, try reinstalling the app — a corrupt installation can leave the flag half-set.

Prevention

The easiest way to avoid this error is to stop using tools that toggle the Windows firewall on and off. I know it's tempting to run those "optimize privacy" scripts that disable a bunch of Windows components in one shot, but they often mess with the WFP state in ways you don't expect. If you do run one, always follow it with a firewall check.

You can check the current state with this command:

netsh firewall show opmode

Look for Operational mode — it should say Enable. If it says Disable, run the fix command again.

Also, keep your security software up to date. Most modern antivirus programs integrate with the firewall properly and don't touch the event collection flag. The one that caused this for me was an old firewall management tool that hadn't been updated since Windows 7. If you're using legacy security software, consider replacing it with something that supports the current Windows versions.

And if you ever need to disable the firewall temporarily for testing, use the proper command:

netsh advfirewall set allprofiles state off

That command disables the firewall without touching the event collection flag. When you're done, turn it back on with:

netsh advfirewall set allprofiles state on

That way you won't have to deal with 0XC0220013 again.