| Previous | Next |
| STATUS_FWP_INVALID_DNS_NAME | STATUS_FWP_IKEEXT_NOT_RUNNING |
STATUS_FWP_STILL_ON
The option could not be turned off because other policy keeps it enabled
These status values come from the Windows Filtering Platform path. For STATUS_FWP_STILL_ON, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.
This status means the attempted disable operation was not enough to turn the feature off. Another provider, policy object, or configuration dependency still requires the engine option.
For STATUS_FWP_STILL_ON, for diagnostics, keep the failing API call, layer or sublayer key, provider context type, filter condition set, callout id, engine state, and whether the Base Filtering Engine, IKEEXT, TCP/IP stack, or L2 path was ready.
What to inspect
- Enumerate policies from all providers, not only the current product.
- Check Group Policy and security software policy refresh.
- Remove the dependent configuration before expecting the option to turn off.
References for STATUS_FWP_STILL_ON
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Windows Filtering Platform
- Microsoft: Audit Filtering Platform Policy Change
Looking for a different code? Search another status or error code.