STATUS_FWP_TIMEOUT (0XC0220012): Fix Transaction Lock Timeout

You're trying to change a firewall rule or install an update, and Windows throws STATUS_FWP_TIMEOUT (0XC0220012) in your face. Annoying, I know.

The real fix is to restart the Base Filtering Engine (BFE) service, which holds the transaction lock. If that doesn't work, you'll need to reset the Windows Filtering Platform. Here's exactly how to do it.

Step-by-step fix for STATUS_FWP_TIMEOUT

Before you start: you need admin rights. If you don't have them, stop and get them. Nothing here works without elevation.

1. Restart the Base Filtering Engine service

1. Press Win + R, type services.msc, and hit Enter. The Services window opens.
2. Scroll down to Base Filtering Engine. Right-click it and choose Restart.
3. If Restart is greyed out, right-click and choose Stop. Wait 5 seconds, then right-click and choose Start.
4. After the service restarts, you should see its Status change to Running and Startup Type remain Automatic.

Try your firewall change again. If the error's gone, you're done. If not, move on.

2. Reset the Windows Filtering Platform

Open an elevated Command Prompt (right-click Start, choose Windows Terminal (Admin) or Command Prompt (Admin)). Run these commands one at a time. After each, you should see Ok. printed on the next line.

netsh winsock reset
netsh int ip reset
netsh advfirewall reset

Each command takes a few seconds. The last one resets your firewall to default settings — you'll lose custom rules, so export them first if you need them. After running all three, reboot your PC. Don't skip the reboot; the changes won't take effect until you do.

3. Check for hung processes holding the lock

Sometimes a third-party firewall or antivirus service grabs the lock and won't let go. Open Task Manager, go to the Details tab, and look for processes like avp.exe (Kaspersky), McAfeeFrameworkHost.exe, or bdservicehost.exe (Bitdefender). If any of these are using high CPU or stuck, end them and restart the BFE service again.

If you're not sure which process is the culprit, use Process Explorer from Microsoft Sysinternals. Find the BFE service, look at its threads, and check which process is holding the lock. It's a bit advanced, but it works.

Why this works

STATUS_FWP_TIMEOUT happens when a transaction (like adding a firewall rule) can't get an exclusive lock on the Windows Filtering Platform database. The BFE service manages that database. If BFE is hung, busy, or deadlocked, any operation that needs the lock times out after 30 seconds and returns 0XC0220012.

Restarting BFE clears the lock and resets the service state. Resetting Winsock and IP stack removes any corrupted network filters that might be causing the deadlock. The firewall reset rebuilds the policy store from scratch, which is why it fixes stubborn cases.

Less common variations

Error appears during Windows Update

Some updates modify firewall rules. If BFE is stuck, the update fails with 0XC0220012. Run the Windows Update troubleshooter (Settings > System > Troubleshoot > Other troubleshooters) and then retry. If that doesn't help, manually download the update from the Microsoft Update Catalog and install it after restarting BFE.

Error only when using a VPN

VPN clients like Cisco AnyConnect or OpenVPN install their own filter drivers. If they crash, they can leave a stale lock. Uninstall the VPN client, reboot, then reinstall it. For Cisco AnyConnect, also delete the C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client folder before reinstalling.

Error on a server with third-party firewall

Symantec Endpoint Protection and similar products sometimes conflict with BFE. Disable the third-party firewall temporarily and see if the error goes away. If it does, check for updates from the vendor — most have fixed this in newer builds.

Error code 0XC0220012 with no obvious cause

Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth in an elevated command prompt. Corrupted system files can break BFE. After both finish, reboot and test again.

Prevention

• Keep Windows updated. Microsoft has patched several BFE deadlock bugs in cumulative updates.
• Don't run two firewalls at once. Pick Windows Defender Firewall or a third-party one, not both.
• After installing or removing a VPN or antivirus, reboot. Don't just close the installer.
• If you manage servers, monitor the BFE service. Set up a alert if it stops or hangs. A quick restart beats a 3 AM outage.
• Export your firewall rules regularly with netsh advfirewall export "C:\backup\firewall.wfw". That way, if you need to reset, you can restore them in seconds.

That's it. Nine times out of ten, restarting BFE clears STATUS_FWP_TIMEOUT. If it doesn't, the full reset will. And if you're still stuck, check for third-party filter drivers — they're the usual suspects.