You're in the middle of a workday, and suddenly your firewall alerts pop up with STATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND (0xC0220006). Or maybe you're trying to push a group policy and it fails with this exact code. I've seen this happen most often right after installing or uninstalling a third-party firewall, VPN client, or security software like Norton or McAfee. One client last month got this after they tried to switch from a corporate VPN to a personal one — the old provider context got orphaned.
What Actually Causes This Error
Windows Firewall uses something called the Windows Filtering Platform (WFP). Think of it as a rulebook for all network traffic. A provider context is like a chapter in that rulebook — it tells Windows which security provider (like a VPN or antimalware) should handle certain traffic. When a program or leftover registry key points to a context that no longer exists, you get error 0xC0220006. The firewall engine can't find the chapter, so it just fails.
Most of the time, it's from incomplete software uninstalls. The program removes its driver but leaves the context registration behind. Other triggers include Windows updates that break firewall rules or manual edits to the netsh rules gone wrong.
The Fix: Reset and Clean Up Rules
Don't waste time digging through Event Viewer for this one. The real fix is to reset the firewall to default and clear orphaned contexts. You'll need admin rights for this.
- Open an elevated command prompt. Press Win + X, choose "Command Prompt (Admin)" or "Terminal (Admin)".
- Reset the Windows Firewall. Run this command:
This wipes all custom rules and provider contexts back to defaults. It's like factory reset for the firewall. You'll need to recreate any custom port rules after.netsh advfirewall reset - Clear the WFP store. Run this to force Windows to rebuild its filter database:
Doesn't fix anything by itself, but next step does. Then:netsh wfp show state
This resets WFP internal state. If that command doesn't work on your version, skip to the registry step.netsh wfp set options = 1 - Check registry for orphaned contexts. Open
regeditand go to:
Look for any entry that references a provider name or GUID you don't recognize from installed software. Delete those keys. Backup first — export the whole key before touching it.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules - Reboot the machine. The firewall service needs a restart to pick up changes.
- Check the firewall is working. Run:
Should show state = ON for all profiles. If not, run:netsh advfirewall show allprofiles
netsh advfirewall set allprofiles state on
What to Check if It Still Fails
If you're still getting the error after a reset, the problem is likely a third-party driver that's not fully removed. Boot into Safe Mode with Networking and run the same steps. Safe Mode stops most services, so you can see if the error disappears. If it does, you've got a driver conflict.
Another common cause: the Windows Firewall service itself is stopped. Check services.msc for the service named "Windows Firewall". Make sure it's set to Automatic and running. Had a client once where a stupid registry tweak disabled it — took me 20 minutes to find it.
If you're in a domain environment, Group Policy can override local rules. Check with your admin if a policy is pushing a bad context. Run gpresult /h gp.html to see applied policies.
Last resort: use System Restore to go back to before the offending software was installed. I've done this more times than I'd like to admit.
One more thing — if you're on Windows 11 22H2 or later, there's a known bug where VPN apps like Cisco AnyConnect leave stale contexts. The fix is the same: reset and reboot. Cisco released a patch in 2023, but not everyone bothered to update.
Bottom line: 0xC0220006 is almost always a leftover from bad software removal. The netsh advfirewall reset is your best friend here. Keep a backup of your custom rules before you run it, or you'll be redoing port forwards for hours.