Fix STATUS_NDIS_INVALID_PORT (0xC023002D) on Windows

Few things are as maddening as a network interface that shows up in Windows but refuses to pass a single packet, especially when you've already tried disabling and re-enabling it three times. The error STATUS_NDIS_INVALID_PORT (0xC023002D) usually shows up right after a VPN client, Hyper-V, or a USB Ethernet dongle gets uninstalled, and Windows is left holding a reference to a port that isn't there anymore. Here's what to do about it.

The fix that works in 9 out of 10 cases

The core problem is that Windows thinks a network port exists on an interface it can't actually talk to. The fix walks in three parts: purge the hidden adapters, reset the network stack, and let Windows rebuild the binding tables from scratch.

Step 1: Show hidden network devices

1. Press Windows + X and pick Device Manager. If you're on Windows 11 22H2 or later, the same shortcut works.
2. Click the View menu at the top.
3. Choose Show hidden devices. You'll now see ghosted entries for hardware Windows remembers but can't find.
4. Expand Network adapters.

You should see grayed-out entries with names like "TAP-Windows Adapter V9", "Hyper-V Virtual Ethernet Adapter", or the specific USB Ethernet chipset you unplugged. Those are the ghosts causing the problem.

Step 2: Remove the ghost adapters

1. Right-click each grayed-out adapter and choose Uninstall device.
2. If Windows asks whether to delete the driver software, tick that box. You don't need it.
3. Repeat for every grayed-out network device, including virtual switches under Network adapters.
4. Also check Network infrastructure devices and Other devices for anything with a yellow warning triangle.

After the last uninstall, the list should look cleaner. Don't reboot yet.

Step 3: Reset the network stack from an elevated command prompt

Open Command Prompt as Administrator (Start menu, type cmd, right-click, Run as administrator) and paste these one at a time. Wait for each to finish before typing the next.

netsh winsock reset
netsh int ip reset
netsh int ipv6 reset
ipconfig /release
ipconfig /renew
ipconfig /flushdns
nbtstat -R
nbtstat -RR

You'll see confirmation lines like "Successfully reset the Winsock Catalog" and "Resetting, OK!". The ipconfig /release step may throw an error on adapters that are already down — that's fine, keep going.

Step 4: Reboot and verify

Restart the machine. After it boots, open Device Manager again and confirm the ghost adapters are gone. Then run:

netsh interface show interface

You should see only the adapters you actually use, each with a clean state. If your physical NIC shows as "Disconnected" but you're plugged in, give it 30 seconds — Windows is rebuilding the binding table after the winsock reset.

Why that fixes it

NDIS sits between your network drivers and the TCP/IP stack. Every interface gets a port number assigned by NDIS. When a VPN client, Hyper-V, or a USB NIC gets ripped out without a clean uninstall, the driver goes away but the port assignment lingers in the registry under HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}. Any app or service that tries to bind to that dead port gets back STATUS_NDIS_INVALID_PORT.

The winsock reset clears the layered service providers, and the ip reset rebuilds the interface table. Together they wipe the stale port mappings and force Windows to re-enumerate from scratch. Uninstalling the ghost adapters first matters because otherwise Windows just re-adds them on the next boot.

Less common variations

Error comes back after every reboot

Something is re-creating the ghost adapter on startup. Common culprits:

• Third-party VPN clients like older Cisco AnyConnect (pre-4.10) or Pulse Secure. Check Services.msc for their helper services and set them to Manual if you don't use them daily.
• Docker Desktop with WSL2 backend — its vEthernet adapter re-creates itself. Stop Docker at startup if you're not using it.
• Corporate endpoint agents (Zscaler, Netskope, Forcepoint) that install a filter driver. These usually need a full uninstall from Programs and Features, not just disabling the service.

Happens only on Hyper-V hosts

If a VM lost its virtual switch, the host's vEthernet adapter can wedge. Remove the virtual switch in Hyper-V Manager, then re-create it. Assigning a NIC team to a virtual switch and then breaking the team is a classic trigger.

USB Ethernet dongles that change MAC address

Some Realtek and ASIX chipsets (notably the RTL8153 in cheap Amazon docks) present a new MAC every plug-in. Windows keeps a port entry for every MAC it's seen, and after a few dozen hot-plugs you hit 0xC023002D. The fix is in the driver's advanced properties: set Network Address to a fixed value, or grab the vendor's signed driver from the chipset maker instead of the generic Windows one.

Happens after a Windows feature update

Windows 10 21H2 to 22H2 and Windows 11 22H2 to 23H2 upgrades have both shipped with NIC binding bugs. Run the same reset above, then check Windows Update > Optional updates > Driver updates for a refreshed NIC driver.

Prevention

Three habits will keep this from coming back:

1. Uninstall VPN and virtualization software properly. Using Revo Uninstaller or the vendor's removal tool beats Programs and Features for anything that touches NDIS.
2. Don't yank USB NICs while they're active. Eject them from the system tray first, or at least disable the adapter in Network Connections before unplugging.
3. Take a System Restore point before installing any network-filtering agent. Corporate security tools are the #1 source of this error in the field.

One last thing: if you're still seeing 0xC023002D after all of this on a machine that's domain-joined, check with your IT team before running the winsock reset. Some enterprise network access control clients get wiped by it and your machine will drop off the network entirely until you re-enroll.