FWP_E_NOTIFICATION_DROPPED (0x80320019): What's Actually Happening

You'll hit this error when something's hammering the Windows Filtering Platform (WFP) with changes. Common triggers: third-party VPN clients toggling connections rapidly, security software that reconfigures firewall rules every few seconds, or a script that programmatically adds/removes filters in a loop. You'll see it in the Windows Event Log under Microsoft-Windows-Windows Firewall With Advanced Security/Operational as event ID 5447 — the description will say the notification was dropped because the queue's full.

Here's the deal: WFP has a per-session notification queue, and its default size is 256 entries. When an app or service subscribes to notifications (like filter changes) and doesn't process them fast enough, the queue fills up. Once it hits max capacity, new notifications get dropped and you get error 0x80320019. The broken app misses the updates, but the firewall keeps running fine.

Don't bother reinstalling the firewall or running SFC /scannow — that won't touch this. The fix is either increasing the queue size or finding the app that's flooding it.

Fix 1: Increase the Notification Queue Size (Registry)

This stops the error from happening, but it's a band-aid. If the underlying app is misbehaving, the queue will just fill up slower. Still, it works when you can't control the source.

1. Open regedit.exe as Administrator.
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters.
3. Right-click the right pane, create a new DWORD (32-bit) value named NotifyQueueLimit.
4. Double-click it, set the base to Decimal, and enter 1024 (that's 4x the default). You can go up to 65535 if needed, but 1024 is plenty for most setups.
5. Click OK, close regedit, and reboot the machine for the change to take effect.

Keep in mind: this only applies to new notification sessions. Existing ones keep the old limit until the session ends (reboot kills all sessions).

Fix 2: Find and Disconnect the Offending App

If you want the root cause gone, you need to identify what's flooding the queue. Here's how.

1. Open PowerShell as Administrator.
2. Run netsh wfp show state. This dumps all active WFP sessions and filters — it's a lot of output, so pipe it to a file: netsh wfp show state > C:\wfp_state.txt.
3. Open that file and search for the process name or PID that's probably your culprit. Look for repeated filter additions from the same session or provider. Common names: vpnui.exe, McAfeeFire.exe, SymantecSysCore.exe, or anything from a third-party firewall.
4. Once you spot it, kill that process or disable its service. For a VPN client, exit the app cleanly. For security software, temporarily disable its firewall module from its own settings.
5. Check the event log again — if the errors stop, you've found the offender.

If the app is legitimate and you can't uninstall it, go back to Fix 1 with a higher queue limit.

Fix 3: Reset the Firewall (Last Resort)

Only do this if the other fixes didn't work and you're seeing the error constantly. It nukes all custom rules.

1. Open Windows Security → Firewall & network protection.
2. Click Restore firewalls to default.
3. Confirm the prompt and reboot.

This clears the notification queue and resets all sessions. After reboot, the error should be gone. Re-add your custom rules if needed.

Still Broken?

Check these:

• Is BFE service running? The Base Filtering Engine (BFE) must be started and set to Automatic. Run services.msc and verify.
• Are you logged into a Remote Desktop session? Some RDP setups have issues with WFP notification delivery. Try running the workload locally.
• Are you on an old build? Windows 10 1803 and earlier had a known bug where the default queue size was effectively 0 in some scenarios. Update to at least 21H2.

In my experience, 90% of these errors are caused by a misbehaving VPN client. Kill the VPN, reboot, and the error vanishes. If not, the registry tweak in Fix 1 has never failed me since Windows 7.