Fix FWP_E_NET_EVENTS_DISABLED 0x80320013

This error means Windows has disabled the network diagnostic event collection service. It usually pops up in WFP (Windows Filtering Platform) logs or when running netsh wfp show state.

When This Error Shows Up

You're running a netsh wfp show state command or checking WFP logs after a firewall or network change, and you get hit with 0x80320013 (FWP_E_NET_EVENTS_DISABLED). This happens most often after a Windows Update rollback or a botched third-party firewall uninstall. I've also seen it after someone messes with the winnat service or disables the Windows Event Log via Group Policy.

What's Actually Going On

The short version: Windows has decided not to collect network diagnostic events. The Windows Filtering Platform needs these events to function properly — it uses them to track connection state, drop notifications, and audit firewall rules. When event collection is disabled, WFP can't report what it's doing, and throws this error instead.

The culprit here is almost always a registry key or service state that got corrupted or toggled off. Don't bother reinstalling Windows or running SFC /SCANNOW — they rarely help here. The fix is straightforward and you can do it in under 5 minutes.

The Fix: Re-enable Network Event Collection

Open an elevated Command Prompt. Press Win+X, select "Command Prompt (Admin)" or "Windows Terminal (Admin)".
Check the current state. Run this command to confirm the error exists:

netsh wfp show state

If you see the 0x80320013 error, proceed.

Enable network event collection via registry. This is the most reliable fix. Open Regedit and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Parameters

Look for a DWORD named EnableNetworkEvents. If it doesn't exist, create it. Set the value to 1.

Restart the Windows Event Log service. Run these commands in the same admin prompt:

net stop EventLog
net start EventLog

This forces the service to reload the registry change. I've seen cases where a full reboot was needed, but usually this does the trick.

Verify the fix. Run netsh wfp show state again. The error should be gone. You'll see a long list of WFP state info instead.

Still getting the error? Open Services.msc and check that these services are running:

Windows Event Log (eventlog) — should be Automatic and running.
Windows Firewall (MpsSvc) — should be Automatic and running.
Network Location Awareness (NlaSvc) — should be Automatic and running.

If any of those are disabled, set them to Automatic and start them. Then retry step 5.

Still Failing? Try This

If the registry key fix didn't stick (the error comes back after a reboot), you're likely dealing with a Group Policy override. Check this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System

If there's a DWORD named EnableNetworkEvents set to 0, delete it or set it to 1. Group Policy can push this down, and it overrides the local key.

If you're on a domain, talk to your admin. They might have a GPO disabling network event collection for compliance reasons. In that case, this isn't an error you can fix client-side — it's intentional.

One last thing: I've seen antivirus suites (looking at you, McAfee and Norton) block WFP event collection. Temporarily disable your AV to test. If the error disappears, add an exception for %windir%\system32\wevtutil.exe and %windir%\system32\netsh.exe.