| Previous | Next |
| STATUS_FWP_TXN_ABORTED | STATUS_FWP_INCOMPATIBLE_TXN |
STATUS_FWP_SESSION_ABORTED
The engine handle has been canceled, not merely disconnected
STATUS_FWP_SESSION_ABORTED means BFE has canceled the client session. The documented cleanup is specific: close the invalid session handle with FwpmEngineClose0, then create a new session with FwpmEngineOpen0. Leaving the client-side handle open leaks client state.
Any explicit transaction in the terminated session is already aborted. Reopening a session is not permission to replay stale operations blindly: first re-enumerate the objects or policy state whose update was in progress, then decide whether the desired changes remain absent.
Recovery evidence
- The API return code and whether RPC/BFE termination occurred near the failure.
- The invalid handle’s close path and the new session key after reopening.
- The status of any transaction and the objects it intended to add or remove.
- Repeated session aborts, which point to the engine/service path rather than one filter definition.
References
- Microsoft: WFP error codes
- Microsoft: WFP sessions, transactions, and object lifetimes
- Microsoft: WFP object model
Looking for a different code? Search another status or error code.