Fix BFE Service Access Denied Error 5 on Windows

The Base Filtering Engine (BFE) service is a core Windows component that manages firewall, Internet Protocol security (IPsec), and filtering policies. When it fails to start with “Access Denied Error 5,” you may lose network connectivity, see firewall errors, or be unable to change network settings. This guide walks you through the most effective fixes, from checking service permissions to repairing system files.

What You’ll Need

Administrator account on the affected Windows PC
Access to Command Prompt or PowerShell (run as administrator)
Optional: Windows installation media (for advanced repair)

Step-by-Step

Restart the BFE service. Press Win + R, type services.msc, and press Enter. Scroll down to Base Filtering Engine, right-click it, and select Restart. If it fails, note the exact error message.
Check the BFE service logon account. In the same services window, right-click Base Filtering Engine and select Properties. Go to the Log On tab. Ensure “Local System Account” is selected and the “Allow service to interact with desktop” checkbox is unchecked. Click Apply and OK.
Verify service dependencies. In the Properties window, go to the Dependencies tab. Note the listed services (e.g., Remote Procedure Call (RPC), DCOM Server Process Launcher). Make sure each of those is running. You can start them from the services list if they are stopped.
Reset the BFE service registry key permissions. Press Win + R, type regedit, and press Enter. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE. Right-click the BFE key, select Permissions, and click Advanced. Make sure SYSTEM and Administrators have Full Control. If not, click Change next to the owner, type SYSTEM, and click Check Names then OK. Then grant Full Control to both accounts.
Run the System File Checker (SFC). Open Command Prompt as administrator (type cmd in Start, right-click, and select Run as administrator). Type sfc /scannow and press Enter. Wait for the scan to finish (may take 15–20 minutes). If it finds corrupted files, it will attempt to repair them.
Run DISM to repair the system image. In the same Command Prompt, type DISM /Online /Cleanup-Image /RestoreHealth and press Enter. This can take up to 30 minutes. It checks for and fixes Windows system image corruption.
Check for third-party security software conflicts. Temporarily disable any third-party antivirus or firewall software (e.g., Norton, McAfee, Bitdefender) and try starting the BFE service again. If it works, re-enable the software and consider updating or reinstalling it.
Perform a clean boot. Press Win + R, type msconfig, and press Enter. On the Services tab, check Hide all Microsoft services, then click Disable all. On the Startup tab, click Open Task Manager and disable all startup items. Restart the PC and try starting the BFE service. If it works, enable items one by one to find the culprit.
Use the Windows Recovery Environment (WinRE) as a last resort. If nothing else works, boot from Windows installation media, choose Repair your computer, then Troubleshoot > Advanced options > Startup Repair. This can fix deeper system issues.

Common Mistakes

Editing the registry without backing it up. Always export the BFE key before making changes.
Changing the service logon to a user account. BFE must run as Local System; using a normal user account will cause access denied errors.
Skipping the DISM step. SFC alone often fails if the underlying system image is corrupt; DISM fixes that first.
Not running Command Prompt as administrator. SFC and DISM require elevated privileges; otherwise they return error 5.

Tips

Create a system restore point before making registry changes.
Use sc query bfe in Command Prompt to check the service status and last error code.
If you recently installed a Windows update, try uninstalling it from Settings > Update & Security > Windows Update > View update history.
Keep your Windows system updated; many BFE issues are fixed by cumulative updates.

Troubleshooting

If the service still fails after these steps:

Check the Event Viewer. Open eventvwr.msc, go to Windows Logs > System, and look for errors with source Service Control Manager. The details may give a specific error code or file path.
Try a system restore. If you have a restore point from before the issue started, use rstrui.exe to roll back.
Run the Windows Update troubleshooter. Go to Settings > Update & Security > Troubleshoot > Additional troubleshooters > Windows Update.
Perform an in-place upgrade. Using the Windows installation media, run setup.exe and choose Upgrade. This reinstalls Windows while keeping your files and apps.
If all else fails, consider a clean install. Back up your data and reinstall Windows. This guarantees a fresh system state.

Frequently Asked Questions

What is the BFE service used for?

It manages Windows Firewall and IPsec policies, and it handles filtering traffic for network connections. Without it, your system may be unprotected or unable to connect to networks.

Why do I get “Access Denied Error 5” when starting BFE?

This usually means the service account lacks the necessary permissions to access system files or registry keys, or the service configuration is corrupted. It can also be caused by third-party security software interfering.

Can I just delete the BFE service and recreate it?

Deleting the service is risky and not recommended. It can leave your system in an unstable state. Use the repair methods described above instead.

Will these steps work on Windows 10 and Windows 11?

Yes, the steps are the same for both Windows 10 and Windows 11, as the BFE service and related tools are unchanged.

How long does the DISM command take?

It can take anywhere from 10 to 30 minutes, depending on your system speed and the extent of corruption. Do not interrupt it.

Is there a way to prevent this error from happening again?

Keep Windows updated, avoid modifying service permissions unless necessary, and ensure your antivirus is compatible with your Windows version. Regular system file checks can also help.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →