| Event Id | 11005 |
| Source | Microsoft Firewall Event |
| Description | Microsoft Firewall failed. The failure occurred during Initialization of Network Address Translation (NAT) because the system call PNATInit failed. Use the source location 308.1151.3.0.1200.166 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. This failure may be due to the Internet Connection Firewall (ICF) service being enabled. If it is enabled, please disable the service named "Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)" (SharedAccess). Then, restart the computer. The error description is: The system cannot find the file specified. Note When you install ISA Server or ISA Server Service Pack 1, Internet Connection Sharing is automatically detected and turned off. |
| Event Information | According to Microsoft: CAUSE ISA Server is configured to install its own NAT driver. The firewall service will not start if any other NAT driver is installed on ISA Server. This problem may occur if any one of the following is true: • You have Routing and Remote Access configured as an Internet connection server with NAT. • You have the Internet Connection Sharing SharedAccess service turned on. • You have the Internet Connection Firewall service turned on (Microsoft Windows Server 2003 only). RESOLUTION To resolve this problem, use one of the following methods. Method 1: You have Routing and Remote Access configured as an Internet connection server with NAT To resolve this problem, follow these steps: 1. Open the Routing and Remote Access Management Console. 2. Expand the server, and then expand IP routing. If you see that the NAT filter is installed, turn off Routing and Remote Access by right-clicking the server. 3. Restart the server. Method 2: You have the Internet Connection Sharing (SharedAccess) service turned on Turn off Internet Connection Sharing (SharedAccess). To do this, follow these steps: 1. Right-click My Network Places, and then click Properties. 2. Select a network adapter. 3. Right-click the adapter, and then click Properties to see if Internet Connection Sharing is turned on. 4. Click the Sharing tab. 5. Click to clear the Internet Connection Sharing check box. 6. Use the services Microsoft Management Console (MMC) to turn off the Internet Connection Sharing service. 7. Restart the server. 8. Repeat this procedure for any other adapter that has Internet Connection Sharing turned on. Method 3: You have the Internet Connection Firewall (ICF) service turned on (Windows Server 2003 only) To resolve this problem, turn off ICF. To do this, follow these steps: 1. Right-click My Network Places, and then click Properties. 2. Sele |
| Reference Links | The firewall service does not start and events are logged in the system event log and in the application event log |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.