Fixing 0XC0220009: STATUS_FWP_ALREADY_EXISTS GUID/LUID conflict

1. Duplicate WFP filters from a botched install or VPN client

I've seen 0XC0220009 most often when a VPN client (Cisco AnyConnect, Pulse Secure) or a security suite (Symantec, McAfee) leaves orphaned WFP filters after an uninstall. The new install tries to register a rule with the same GUID or LUID, and the kernel says “nope, that one's already taken.”

The fastest fix? Dump the filter store and let the system rebuild it.

1. Open an elevated Command Prompt (Win+X > Terminal Admin).
2. Run netsh wfp show state — this spits out a monster XML file. Search it for 0xC0220009 or the GUID in your error. Note the filter ID.
3. Kill that specific filter: netsh wfp delete filter <filterId>
4. If the filter won't delete (permission issue), reset the whole store: netsh wfp set options reset_store

Important: Resetting the store won't break your firewall rules — the Base Filtering Engine (BFE) service recreates them on next boot. But you'll lose any custom WFP callout drivers. That's fine for 99% of people.

Still stuck? Reboot after the reset, then retry whatever action triggered the error (installing a VPN, enabling a firewall rule).

2. Third-party firewall or antivirus holding a lock

This is the sneaky one. A security product registers a WFP filter at boot, then its UI crashes, leaving the filter orphaned. When Windows or another app tries to register a rule with the same GUID, boom — 0XC0220009.

The sign: you see the error right after installing/updating a security suite, or after a malware scan that flagged a WFP driver.

1. Disable all non-Microsoft firewall and antivirus — not just the UI, but the core service. For example, for McAfee: sc stop McAfeeEngineService then sc config McAfeeEngineService start= disabled.
2. Reboot into Safe Mode with Networking. That loads only essential drivers, which often bypasses orphaned WFP filters.
3. In Safe Mode, run netsh wfp show state again and look for filters tied to the third-party service's GUID. Delete them with netsh wfp delete filter.
4. Reboot normally, re-enable your security software, and test.

If the error returns, you've got a driver that auto-creates the duplicate filter on boot. In that case, uninstall the security suite completely using the vendor's removal tool (e.g., McAfee Consumer Product Removal Tool or Symantec Removal Tool).

3. Corrupted BFE service state

Less common but nasty. The Base Filtering Engine (BFE) itself has a corrupted internal database of GUIDs/LUIDs. You'll see 0XC0220009 for any new WFP rule, even simple ones like “allow ping.”

Diagnostic test: Try creating a test rule with PowerShell: New-NetFirewallRule -DisplayName 'TestRule' -Direction Inbound -Protocol TCP -LocalPort 9999 -Action Allow. If that also throws 0XC0220009, BFE is corrupt.

1. Stop BFE: sc stop BFE
2. Navigate to C:\Windows\System32\drivers\ and rename WFP.db to WFP.old. If you don't see that file, check C:\Windows\System32\config\systemprofile\AppData\Local\ for a hidden WFP folder.
3. Start BFE: sc start BFE
4. Recreate your firewall rules from scratch. The old ones will be gone.

Pro tip: Export your existing rules first: netsh advfirewall export "C:\firewall-backup.wfw". Then after you fix BFE, import them: netsh advfirewall import "C:\firewall-backup.wfw". This avoids the manual re-creation headache.

Quick-reference summary

Most people will get away with the first fix. If you're still wrestling with 0XC0220009 after trying all three, you might have deeper driver conflicts — try a system restore to a point before the error started. And yeah, I know how infuriating this error is. But you've got this.