Fix FWP_E_PROVIDER_NOT_FOUND (0x80320005) on Windows Firewall

What's happening here

You're seeing FWP_E_PROVIDER_NOT_FOUND (0x80320005) when trying to configure Windows Firewall — maybe after uninstalling Norton, McAfee, or a VPN client. The error means the Windows Filtering Platform (WFP) is looking for a provider that was registered by that software, but the provider's gone after the uninstall. The registry still says it's there, but the binary backing it isn't. Windows Firewall can't talk to something that doesn't exist, so it throws this error.

Real-world trigger: You removed Bitdefender Total Security, rebooted, then tried to enable Windows Defender Firewall from the control panel. You got the error on the first try. Or maybe you updated Windows 10 22H2 and a third-party firewall driver broke during the upgrade.

I've fixed this on Windows 10 and 11, both 21H2 and later builds. The fix that works depends on whether it's a leftover provider ID or a corrupted WFP store. Let's go level by level.

Level 1: Quick fix (30 seconds) — Reset the network stack

This clears temporary provider references that Windows caches in the WFP session. It won't fix a permanently orphaned provider, but it's the first thing to try because it's harmless and fast.

1. Open Command Prompt as administrator — hit Win + X, select Terminal (Admin) or Command Prompt (Admin).
2. Run these commands in order:

   netsh int ip reset
   netsh winsock reset

3. Close the prompt and restart your PC.

Why this might work: netsh winsock reset rebuilds the Winsock catalog, which includes some WFP provider associations. If the missing provider was just a stale reference in Winsock, this flushes it. But if the provider is hard-registered in the WFP base filtering engine (BFE), this won't touch it. You'll know in 30 seconds.

Level 2: Moderate fix (5 minutes) — Remove orphaned providers via registry

If the quick fix didn't work, the provider ID is likely stuck in the registry under the WFP providers key. Windows Firewall reads this during start. A dead entry here triggers the error every time.

1. Press Win + R, type regedit, hit Enter.
2. Navigate to:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Provider
3. Look for subkeys with names like {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}. Each one is a registered WFP provider. You'll see a name value inside — something like "Symantec Firewall Provider" or "NordVPN WFP Provider".
4. If you see a provider from software you've already uninstalled, right-click the subkey and delete it. Be careful — don't delete Microsoft or Windows entries (the name will say "Microsoft" or "Windows").
5. Close regedit and restart.

The reason this works: BFE loads all providers from this registry path at boot. A missing provider file but a present registry entry means BFE tries to bind to something that's not there. Deleting the entry removes the reference. Windows will recreate default providers if needed.

Level 3: Advanced fix (15+ minutes) — Reset the entire WFP store

If neither fix above worked, the WFP store itself is probably corrupted — maybe from a botched security suite removal that deleted shared provider DLLs. This is the nuclear option. It resets all WFP policies, including Windows Defender Firewall rules, to factory defaults.

1. Open Command Prompt as administrator.
2. Stop the BFE service:
   net stop bfe
3. Back up the current WFP store (in case you need to recover):
   copy C:\Windows\System32\spp\store\2.0 C:\WFP_backup
4. Delete the store contents:
   del /f /s /q C:\Windows\System32\spp\store\2.0\*
5. Restart BFE:
   net start bfe
6. Run the WFP reset command:
   netsh wfp reset
7. Restart your PC.

After the reboot, Windows will rebuild the WFP store from scratch. You'll lose any custom firewall rules you added, but the error will be gone. If you have critical firewall rules, export them first with netsh advfirewall export "C:\firewall_rules.wfw".

I've seen this fix work on Windows 10 22H2 after a Comodo Firewall uninstall left the system in a state where even netsh advfirewall reset threw the same error. The store was empty but BFE kept referencing a missing provider GUID. Deleting the store forced a clean rebuild.

When none of these work

If you're still stuck, the problem might be a third-party driver that didn't uninstall cleanly. Check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services for entries with display names matching your old security software. Delete those service keys (back up first), then repeat the Level 3 reset.

Also check %ProgramFiles% and %ProgramFiles(x86)% for leftover folders from the security software. Some installers leave driver files that load at boot even after the software is gone. Use Autoruns from Sysinternals to find them — that's a separate deep-dive topic, but worth mentioning.