I've seen this error pop up on machines running third-party VPNs or after a Windows update that changed firewall rules. The error code 0XC0220016 means the Windows Filtering Platform (WFP) found two firewall rules that are supposed to be linked but have different lifetimes — like one rule expires in an hour and the other lasts forever. That mismatch stops the whole firewall operation cold.
Here's the fix that works for most people. It's a two-minute job.
Reset the Windows Firewall Policy
Open an elevated Command Prompt. Hit the Windows key, type cmd, right-click Command Prompt, and pick Run as administrator. Click Yes on the UAC prompt.
Run this command:
netsh advfirewall resetYou should see back
Ok.
That's it. The command resets the Windows Firewall policy back to its default state. All custom rules you added are gone. But also any broken or orphaned rules with mismatched lifetimes are deleted. That's what causes 0XC0220016 — those orphaned rules with conflicting expiration times.
After the command finishes, reboot your PC. Once you're back at the desktop, try the operation that gave you the error before. For most users, it just works now.
Why resetting the firewall fixes this
The Windows Filtering Platform uses a kernel-mode driver to manage firewall rules. Every rule has a lifetime — either it's persistent (never expires) or it's dynamic (created by an app or service, and lives only as long as that app runs). When you have leftovers from an uninstalled VPN or a failed Windows update, you can get one rule that's persistent and another that's dynamic, but they're linked together somehow. The system sees the mismatch and throws 0XC0220016 instead of applying the rules.
Resetting the firewall clears all rules — persistent and dynamic — and replaces them with the default Windows security policies. That eliminates the mismatch. Think of it as a factory reset for your firewall.
Less common variations of the same issue
Sometimes resetting the firewall doesn't completely fix it, especially on domain-joined machines. Here's what to check next.
Group Policy overriding the reset
If your PC is on a corporate domain, group policy may push firewall rules down after the reset. In that case, the mismatch might come back after the next GP update. You can check this by running rsop.msc and looking under Windows Settings > Security Settings > Windows Firewall. If you see policy-set rules, talk to your IT admin — they'll need to fix the source policy.
Third-party firewall apps
Antivirus suites with firewall modules (Norton, McAfee, Bitdefender) often install their own WFP drivers. Those drivers can create rules with different lifetimes than Windows expects. Uninstall the third-party firewall completely, then reset the Windows Firewall again. Reinstall the third-party product fresh. That usually gets the lifetimes back in sync.
Corrupted Windows Filtering Platform store
In rare cases, the WFP store files themselves get corrupted. You'll know because the netsh advfirewall reset command runs without errors but the problem persists. To fix that, run a System File Checker scan:
sfc /scannowLet it finish — it'll replace corrupted system files. Then reset the firewall again.
Preventing this from coming back
Avoid installing multiple VPNs or firewall products on the same machine. They don't play well with WFP lifetimes. If you uninstall a VPN, always reboot after the uninstall. That ensures any leftover firewall rules from that VPN are properly cleaned up.
Also, keep Windows updated. Microsoft has patched several WFP-related lifetime bugs in cumulative updates for Windows 10 and 11. Run Windows Update monthly, at minimum.
If you manage multiple machines, consider pushing a scheduled task that runs netsh advfirewall reset once a quarter on workstations. It's a cheap insurance policy against cumulative WFP rule bloat.