What does NTSTATUS 0xC0220011 (STATUS_FWP_INCOMPATIBLE_TXN) mean?

STATUS_FWP_INCOMPATIBLE_TXN

The transaction mode does not permit this policy change

STATUS_FWP_INCOMPATIBLE_TXN is returned when a write-capable operation is made inside a read-only WFP transaction. The filter engine preserves a separate mode for consistent read/enumeration work; it does not implicitly upgrade that transaction to allow changes.

For example, FwpmFilterAdd0 and filter deletion cannot be used inside a read-only transaction. Decide at transaction start whether the batch is observational or mutating; restarting the operation in a write transaction is safer than mixing an update into a snapshot workflow.

What to compare

• The flags passed to FwpmTransactionBegin0 and the intended operation type.
• Whether a helper opened a read-only transaction for enumeration before a later add/delete call.
• The access rights needed for a write transaction and referenced WFP objects.
• The final policy state after rerunning the change in an appropriate transaction.

References

• Microsoft: FwpmFilterAdd0
• Microsoft: FwpmFilterDeleteByKey0
• Microsoft: WFP transactions

Looking for a different code? Search another status or error code.