STATUS_FWP_INVALID_FLAGS (0XC022001E) – Quick Fix

You're staring at STATUS_FWP_INVALID_FLAGS (0xC022001E) and wondering why your firewall or VPN just died.

I get it. This error pops up out of nowhere—usually after a Windows update, a driver reinstall, or when some third-party antivirus decides to mess with your firewall rules. The good news: it's almost always fixable without reformatting. Here's the fix I've used on maybe 50 machines over the last few years.

Step 1: Reset the Windows Firewall (the real fix)

Skip the registry hunting. Go straight to the command line. Run this as Administrator:

netsh advfirewall reset

That's it. It wipes all custom rules and resets the Windows Filtering Platform (WFP) flags to default. I've had this fix work on Windows 10 22H2 and Windows 11 23H2. Your firewall will be back to factory settings—you'll need to re-add any custom rules you had.

If you need to keep the firewall running but want to be less nuclear, try this first:

netsh advfirewall export "C:\backup-firewall-rules.wfw"

Then reset. If the fix works but you lose something critical, you can import the backup later (netsh advfirewall import). But honestly, 9 times out of 10, the reset alone does it.

Had a client last month—a small accounting firm—whose entire VPN connection dropped after a Windows 11 feature update. Error 0xC022001E popped up in the Event Viewer under Microsoft-Windows-Windows Firewall With Advanced Security. Reset fixed it in 2 minutes. They lost their custom RDP port forward rule, but I restored it manually in 30 seconds.

Why this works

The Windows Filtering Platform uses flags to mark rules as active, boot-time, or persistent. When a driver update or a botched antivirus installation corrupts these flags, WFP throws 0xC022001E because the flags field doesn't match what it expects. Resetting the firewall rewrites all the low-level WFP objects with the correct flag values. It's like clearing a corrupted database cache—you lose the custom data, but the structure works again.

Don't waste time hunting specific corrupt rules in the GUI. The WFP state is a kernel-level structure—you can't edit it with a check box. The reset command rebuilds it from scratch.

Less common variations

1. Group Policy overrides your reset

If you're on a domain-joined machine and Group Policy pushes firewall rules, resetting locally won't help. The policy will reapply the bad flag values on the next refresh. Check with your IT admin to see if a policy change triggered the error. They can either fix the policy or remove the corrupt rule from the GPO.

2. Third-party antivirus with WFP drivers

Some antivirus apps (looking at you, older Norton and McAfee versions) install WFP callout drivers that can mess with flag validation. Disable the antivirus temporarily, reset the firewall, then re-enable it. If the error comes back, uninstall the antivirus entirely and switch to something lighter—I've had good luck with Windows Defender + occasional Malwarebytes scans.

3. Corrupt registry keys (rare)

In maybe 1 in 20 cases, the registry path HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy gets a corrupt key. Export that key before messing with it, then delete the subkeys under FirewallPolicy and reboot. The system recreates them fresh. But I only go here if the netsh reset fails.

Prevention

• Set a System Restore point before any Windows update or driver install. If the error appears, roll back the update first, then apply the fix. I've seen this error triggered specifically by KB5025239 on Windows 10.
• Don't run multiple security products. Two firewalls or two antivirus apps fighting over WFP flags is a recipe for 0xC022001E.
• Export your firewall rules monthly with netsh advfirewall export "C:\backup\firewall-<date>.wfw". When you need to reset, you don't lose everything.
• Use Windows Defender Firewall with Advanced Security instead of third-party apps. It's less prone to flag corruption because Microsoft tests it against every Windows update.

That's it. If you hit this error again, you now know the drill—netsh reset, check Group Policy, ditch the conflicting antivirus. You'll be back up in 5 minutes.