Fix FWP_E_DUPLICATE_KEYMOD 0x8032002B Windows Firewall

Cause #1: Third-Party Firewall Software Left Behind Junk

Most times I see this error, it's because a third-party firewall or VPN client was uninstalled but didn't clean up its Windows Filtering Platform (WFP) filters. The leftover policy has a duplicate keying module entry. Windows Firewall throws FWP_E_DUPLICATE_KEYMOD because it won't accept a policy that references the same keying module twice.

You'll usually hit this when applying a new IPsec policy or trying to start the Windows Firewall service. It can also pop up after a Windows update resets some firewall components, exposing the junk left behind.

The Fix: Clean Up WFP Filters and Reset the Firewall

First, make sure the offending software is fully removed. Use the vendor's cleanup tool if they have one. Then, reset the Windows Firewall rules and WFP state:

netsh advfirewall reset

That resets all firewall rules to default. But it doesn't always clear WFP filters. For that, you need to restart the Base Filtering Engine service and its dependencies. Fire up an elevated command prompt and run:

net stop bfe && net start bfe

If BFE won't stop (common if other services depend on it), reboot into Safe Mode with Networking and run the same commands. In Safe Mode, BFE isn't as locked down.

After that, reapply your firewall policy. If you're using a custom IPsec policy via netsh ipsec static, delete and recreate it:

netsh ipsec static delete policy name="YourPolicy"

Then re-add it fresh. I've seen this work in about 80% of cases.

Cause #2: Group Policy Conflict from a Domain Environment

The second most common scenario: you're on a domain-joined machine and the local firewall policy clashes with one pushed down by Group Policy. The domain policy might define an IPsec rule with a keying module that's already in use locally. When the two merge, you get the duplicate key.

You'll notice this error in the Event Viewer under Microsoft-Windows-Windows Firewall With Advanced Security/Operational right after a GP update.

The Fix: Override or Align Group Policy

Don't bother trying to edit local policy if GP overrides it — it won't stick. What you need is to align the local policy with what the domain expects. Check the effective policy:

gpresult /h gp_report.html

Open that HTML file and look for the Windows Firewall policy sections. Note which IPsec rules are applied. Then, modify your local rule to use the same keying module (usually IKEv2 or AuthIP) and remove any conflicting one.

If you don't have access to the domain GPOs, you can force a local override by setting this registry key:

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\Policy\LocalFirewallRules

But honestly, the clean fix is to get your network admin to remove the duplicate rule from the GPO. I've seen admins accidentally leave old IPsec rules active when they migrated to a new one.

Cause #3: Corrupted Windows Firewall Service or Missing Registry Entries

Less common, but I've seen it after botched system restores or aggressive registry cleaners (stop using those, by the way). The Windows Firewall service relies on a set of registry keys under HKLM\SYSTEM\CurrentControlSet\Services\BFE and ...\mpssvc. If any of those get corrupted or set to the wrong value, you can get weird WFP errors.

You'll know it's this when the error shows up even after a clean boot and no third-party firewall is installed.

The Fix: Restore Default Registry Keys

First, export the current keys as backup:

reg export "HKLM\SYSTEM\CurrentControlSet\Services\BFE" C:\bfe_backup.reg

Then compare them to a healthy machine if you have one. The key thing is the Start value under BFE should be 2 (auto) and under mpssvc it's 2 as well. If they're off, fix them:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\BFE" /v Start /t REG_DWORD /d 2 /f

If you don't have a reference, the nuclear option is to use sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth. That'll replace corrupted system files including service DLLs. Run DISM first, then SFC. It takes a while but it's saved my ass more than once.

After that, reboot and try applying your policy again.

Quick Reference

That's the short of it. Start with the first fix — it's the most common and simplest. If that doesn't kill it, move down the line. You'll get this resolved.