The Microsoft Firewall service does not start and event ID 7024 is logged in the system event log of the computer that is running ISA Server 2004 (837864)


The information in this article applies to:

  • Microsoft Internet Security and Acceleration Server 2004, Standard Edition

SYMPTOMS

When you try to restart the Microsoft Firewall service, it does not start successfully and the following event ID message is logged in the system event log: Event type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: date
Time: time
User: N/A
Computer: computername
Description: The Microsoft Firewall service terminated with service-specific error 2147549183 (0x8000FFFF).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Additionally, all the following event messages are logged in the application event log: Event type: Error
Event Source: Microsoft ISA Server Web Proxy
Event Category: None
Event ID: 14146
Date: date
Time: time
User: N/A
Computer: computername
Description: ISA Server failed to load Web Filter DLL C:\Program Files\Microsoft ISA Server\\LinkTranslation.dll. The error code shown in the Data area of the event properties indicates the cause of the failure.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff ff 00 80 ÿÿ.? Event type: Error
Event Source: Microsoft ISA Server Web Proxy
Event Category: None
Event ID: 21159
Date: date
Time: time
User: N/A
Computer: computername
Description: Web filters cannot be initialized, or updated changes cannot be applied. To resolve this error, Check recent changes made to Web filters configuration.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff ff 00 80 ÿÿ.? Event type: Error
Event Source: Microsoft ISA Server Web Proxy
Event Category: None
Event ID: 14127
Date: date
Time: time
User: N/A
Computer: computername
Description: The Web Proxy service could not initialize (error code 501.2643.4.0.1872.0). The internal error code in the Data area of the event properties indicates the cause of the failure.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff ff 00 80 ÿÿ.? Event Type: Error
Event Source: Microsoft ISA Server Web Proxy
Event Category: None
Event ID: 14127
Date: date
Time: time
User: N/A
Computer: computername
Description: The Web Proxy service could not initialize (error code 505.83.4.0.1872.0). The internal error code in the Data area of the event properties indicates the cause of the failure.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff ff 00 80 ÿÿ.? Event Type: Error
Event Source: Microsoft Firewall
Event Category: None
Event ID: 14060
Date: date
Time: time
User: N/A
Computer: computername
Description: Cannot load an application filter Web Proxy Filter ({4CB7513E-220E-4C20-815A-B67BAA295FF4}). FilterInit failed with code 0x8000ffff. To attempt to activate this application filter again, stop and restart the Firewall service.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Error
Event Source: Microsoft Firewall
Event Category: None
Event ID: 14001
Date: date
Time: time
User: N/A
Computer: computername
Description: Firewall Service failed to initialize. Previous event log entries might help determine the proper action.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

CAUSE

This issue may occur if a Web publishing rule is corrupted in the Microsoft Internet Security and Acceleration (ISA) Server 2004 firewall policy.

RESOLUTION

To resolve this issue, determine the Web publishing rule that is corrupted, and then remove the corrupted rule or reconfigure the link translation dictionary for that rule. To do this, follow these steps:
  1. To help determine the Web publishing rule that is corrupted, disable link translation on each Web publishing rule, and then try to start the Microsoft Firewall service. To do this, follow these steps:
    1. Start the ISA Server Management tool.
    2. Expand ServerName, where ServerName is the name of your ISA Server computer.
    3. Click Firewall Policy, click a Web publishing rule, and then click Edit Selected Rule.
    4. Click the Link Translation tab, click to clear the Replace absolute links in Web pages check box, and then click OK.
    5. Click Apply to update the firewall policy, and then click OK.
    6. Try to start the Microsoft Firewall service. If the service starts successfully, this rule may be corrupted.
  2. If the Microsoft Firewall service does not start successfully, reenable link translation for the previous rule, and then disable it on the next rule.
  3. When you have identified the corrupted rule, remove that rule, or edit the link translation dictionary entries for that rule.

    Note When you create a new Web publishing rule, and when you click to select the Replace absolute links in Web pages check box on the Link Translation tab of that rule, a new link translation dictionary is automatically created for that rule.

MORE INFORMATION

For additional information about link translation, search for "link translation dictionary" in ISA Server 2004 Help.
Modification Type:MajorLast Reviewed:7/16/2004
Keywords:kbEventLog kbFirewall kbprb KB837864 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.