When Windows throws FWP_E_LAYER_NOT_FOUND (0x80320004), it kills your network stack — apps can’t connect, Windows Defender goes silent, and services fail to register. Annoying as hell. Here’s the fix, then the explanation.
The Fix: Reset the Windows Filtering Platform
Open an admin command prompt. Right-click Start, select Windows Terminal (Admin) or Command Prompt (Admin).
Run this:
netsh wfp reset
You’ll get OK. or a message that the operation completed. Reboot immediately — don’t try to use the system without restarting. The reset only takes effect after boot.
If you also see other network errors (like 0x8007274c or socket failures), add the winsock reset as well:
netsh winsock reset
netsh int ip reset
Then reboot again. That covers the full network stack reset.
Why This Works
The Windows Filtering Platform (WFP) manages network filtering — think firewall rules, network inspection, and security policies. Each filter is attached to a layer (like FWPM_LAYER_INBOUND_IPPACKET_V4). These layers are registered at boot by the WFP base engine (Bfe service).
What’s actually happening here is that the WFP state store got corrupted — usually after a Windows update that partially failed, or after a third-party security tool (Norton, McAfee, Symantec) tried to install its own filters and left a mess. The error 0x80320004 means a program or service tried to reference a layer by GUID, and the WFP engine couldn’t find it in its active list. The layer GUID still exists in the registry, but the runtime object is gone.
netsh wfp reset doesn’t just flush filters — it removes the entire WFP configuration store, including all custom layers and filters that third-party apps installed. Then on reboot, the WFP engine re-registers all built-in layers fresh from the system files (%SystemRoot%\system32\drivers\wfplwfs.sys and related drivers). No leftover junk, no orphaned layers.
The reason step 3 works (adding winsock and IP resets) is that sometimes the error cascades: WFP errors block Winsock from initializing, which then breaks IP configuration. Resetting both ensures the entire stack is clean.
Less Common Variations
Sometimes netsh wfp reset fails with Access denied even when running as admin. That points to a corrupted WFP filter driver or a security product that's locking the store. In that case:
- Boot into Safe Mode with Networking — hold Shift while clicking Restart, then Troubleshoot > Advanced Options > Startup Settings > Safe Mode with Networking.
- Run the same
netsh wfp resetcommand there. Safe Mode strips out third-party filter drivers, so the reset can proceed. - Reboot normally.
Another variant: the error shows up in Event Viewer under Windows Filtering Platform with Event ID 5447, but your network is fine. That’s usually a single app (like a VPN client or a game) trying to register a filter at an invalid layer. The fix is to update or reinstall that specific app. Check the event log — it lists the process name.
Prevention
This error comes back if you let third-party firewall or security suites mess with WFP. Windows Defender is good enough for 99% of people. If you must use a third-party tool, uninstall it completely before a Windows feature update — the upgrade process can corrupt WFP if the vendor’s filters don’t migrate cleanly.
Also, avoid running multiple network monitors (Wireshark, Npcap, Proxifier) simultaneously. They install WFP callout drivers that can conflict and orphan layers. Stick to one at a time.
If you’re a developer writing software that uses WFP, always call FwpmEngineOpen with a proper session handle and clean up layers during uninstall. Leaving orphan layers is what triggers this error for your users.
Bottom line: one netsh command and a reboot fixes it. If that fails, Safe Mode. If that fails, it’s a corrupt driver — reinstall the WFP driver from an admin prompt with sc config Bfe start= auto && sc start Bfe and reboot. But the reset handles 95% of cases.