NTSTATUS 0xC0220013 (STATUS_FWP_NET_EVENTS

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

WFP network diagnostic-event collection is disabled for the filter engine.

Previous	Next
STATUS_FWP_TIMEOUT	STATUS_FWP_INCOMPATIBLE_LAYER

STATUS_FWP_NET_EVENTS_DISABLED

The requested diagnostic feed is disabled, not necessarily the filter policy

STATUS_FWP_NET_EVENTS_DISABLED concerns collection of WFP network diagnostic events. It does not say that the Base Filtering Engine, Windows Firewall rules, or packet classification are stopped. The distinction is important when a diagnostic subscriber receives no event after an observed block or permit decision.

Query the engine option before changing it. FWPM_ENGINE_COLLECT_NET_EVENTS uses a FWP_UINT32 value of 0 or 1; enabling it requires an eligible non-dynamic, non-transactional engine session with write access. Its setting persists across restarts.

Targeted checks

FwpmEngineGetOption0 for FWPM_ENGINE_COLLECT_NET_EVENTS.
The session type, explicit transaction state, and FWPM_ACTRL_WRITE access before using FwpmEngineSetOption0.
Keyword settings when inbound broadcast or multicast events are expected.
The distinction between disabled event collection and a rule that simply did not match.

References

Looking for a different code? Search another status or error code.