What does HRESULT 0x80320007 (FWP_E_SUBLAYER_NOT_FOUND) mean?

 
Previous Next
FWP_E_PROVIDER_CONTEXT_NOT_FOUND FWP_E_NOT_FOUND

FWP_E_SUBLAYER_NOT_FOUND

FWP_E_SUBLAYER_NOT_FOUND means that the filter targets a sublayer that is not present. Sublayers are used within each WFP layer to organize competing policies and determine how terminating filters interact, so replacing a missing sublayer with the default one can change security behavior.

Check the policy boundary

  • Confirm the exact sublayer GUID and whether the product is expected to create it before adding filters.
  • Determine whether the sublayer belonged to a provider or dynamic session that was removed.
  • Check filter priority and arbitration assumptions; a filter that works in one sublayer may not have the same effect in another.

Safe fix

Restore the product’s intended sublayer and reapply filters through an idempotent transaction. Microsoft specifically recommends that providers use their own sublayer rather than sharing another provider’s sublayer, because otherwise terminating filters can prevent each other from being evaluated.

Microsoft: WFP error codes · Microsoft: layers and sublayers · Microsoft: use your own sublayer


Looking for a different code? Search another status or error code.