STATUS_FWP_CALLOUT_NOT_FOUND Fix: 0xC0220001 on Windows

I know this error is infuriating. You're trying to install a VPN client or update your firewall software, and suddenly Windows throws STATUS_FWP_CALLOUT_NOT_FOUND (0xC0220001) at you. The callout doesn't exist anymore—but something still references it. This usually happens after you uninstall a security tool like McAfee, Norton, or a corporate VPN (Pulse Secure, Cisco AnyConnect), and the uninstaller left a dead pointer behind. Or during an install when the software tries to register a callout that conflicts with a leftover from a previous version.

What's actually breaking?

The Windows Filtering Platform (WFP) manages network traffic filtering. A "callout" is a small driver or DLL that hooks into WFP to inspect or modify packets. When an installer tries to register a callout, WFP checks if it already exists. If the uninstaller didn't remove the old registration cleanly, you get this error. The callout's GUID is still in the WFP store, but the file is gone. So WFP says, "I see the reference, but where's the code?" That's the 0xC0220001.

The fix: clean up orphaned callouts

You've got two roads here. The quick one works for most people. The longer one is for stubborn leftovers. Let's start quick.

Step 1: Run the WFP diagnostics tool

Open Command Prompt as Administrator (search for cmd, right-click, Run as administrator). Type:

netsh wfp show state

This dumps the entire WFP state. Look for entries with a status like "deleted" or "orphaned". Pay attention to any lines with your firewall or VPN software's name. If you see callout entries with a GUID and no associated binary, that's your culprit.

Step 2: Remove the orphaned callout

You can't delete a WFP callout directly with netsh. Instead, you'll use the sc command to stop the offender's service. First, find the service name. Check the output from step 1 for a service name like YourVPN_SERVICE or McAfeeFirewall. Then run:

sc query YourVPN_SERVICE

If it shows STATE: STOPPED or STATE: UNINSTALLED, delete it:

sc delete YourVPN_SERVICE

Reboot. Then try your install again.

Step 3: If that doesn't work—use the WFP cleanup tool

Microsoft has a hidden tool called wfpcleanup.exe in the Windows SDK. But I don't recommend that—it's too aggressive and can break Windows Defender. Instead, use Process Monitor (from Sysinternals) to capture the exact GUID of the failing callout. Here's how:

1. Download Process Monitor from Microsoft's site.
2. Run it as Administrator. Set a filter: Process Name contains msiexec (or your installer's name).
3. Start your failing install. Watch for FWP_CALLOUT_NOT_FOUND in the result column.
4. Note the GUID in the detail column—looks like {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}.

Now open an elevated PowerShell and run:

$guid = "{your-guid-here}"
Remove-NetFirewallRule -Name $guid -ErrorAction SilentlyContinue
Remove-NetIPsecRule -Name $guid -ErrorAction SilentlyContinue

This removes any firewall or IPsec rules referencing that callout. Reboot and try again.

Step 4: Last resort—reset WFP completely

If you're still stuck, you can reset the whole WFP store. This will reset all firewall rules, including Windows Defender Firewall defaults. You'll need to re-add any custom rules later. Run:

netsh advfirewall reset

Then:

netsh int ip reset

Reboot. This often clears the ghost callouts. But it's a sledgehammer—use it only after the other steps fail.

What to check if it's still broken

Occasionally the problem isn't the callout itself but a corrupted WFP security descriptor. Check the Application and System event logs for Event ID 5447 or 5440. Those logs show WFP policy changes and will tell you exactly which callout GUID failed. If you see repeated 5447 entries with the same GUID, you can manually delete the registry key at HKLM\SYSTEM\CurrentControlSet\Services\WFP\Callout under that GUID. But back up the key first—messing with the registry here can tank your network stack.

Another thing: some third-party antivirus software (looking at you, Webroot and Trend Micro) inject their own callouts and lock them. Uninstall them cleanly using their official removal tool, then reboot. The WFP store should release the orphaned callout.

One more—check if the Base Filtering Engine service (BFE) is running. If it's stopped, WFP can't load anything. Set it to Automatic and start it:

sc config BFE start= auto
sc start BFE

Then retry. This tripped me up the first time too—I spent an hour chasing ghost callouts when BFE was just sitting there disabled.

Once you've cleaned the orphan, your install should sail through. If not, let me know in the comments what software you're dealing with—some corporate VPNs have their own uninstall quirks.