NTSTATUS 0xC0220015 (STATUS_FWP_KM_CLIENTS

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The requested WFP operation is available only to a kernel-mode caller.

Previous	Next
STATUS_FWP_INCOMPATIBLE_LAYER	STATUS_FWP_LIFETIME_MISMATCH

STATUS_FWP_KM_CLIENTS_ONLY

The API boundary is kernel-mode, not an elevation failure

STATUS_FWP_KM_CLIENTS_ONLY means the requested operation is restricted to a kernel-mode WFP client. Running a user-mode process as administrator does not change that boundary, because the status describes caller mode rather than ordinary object access rights.

First identify whether the desired outcome actually requires a callout driver or whether the WFP user-mode management API can express the policy. Microsoft’s WFP guidance notes that some network controls can be implemented in user mode without a callout driver; a driver is warranted only when the needed processing path is kernel-only.

What to decide

The exact API and the documented required caller mode.
Whether a user-mode filter/provider model can implement the intended policy.
The WDM/KMDF driver and signing/deployment implications if a callout is required.
The boundary between user-mode configuration and kernel-mode classification code.

References

Looking for a different code? Search another status or error code.