🖥️ VMware Horizon Agent “Protocol Error” — Fixed by Windows Firewall Configuration

Overview

Recently, I encountered an issue where several Horizon Agent–based virtual desktops in our environment showed the status “Starting other services” or “Protocol Error” in the Horizon Administrator console.
Even after reinstalling the Agent (version 2206), the problem persisted.

---

Symptoms

• Horizon Agent status: “Starting other services” → “Protocol error”

• Horizon main services appeared to be running normally

• Event Viewer showed Event ID 7000 for services such as:

  • PASVC – failed to start

  • LUFAV – not installed

• Reinstalling the Agent (even using Repair mode) did not solve the issue

---

Root Cause

After deeper inspection, we discovered that on the affected VMs:

Windows Defender Firewall (Domain Profile)
→ “Block all incoming connections, including those in the list of allowed apps”
was checked (enabled).

This setting silently blocks all inbound traffic, even for applications explicitly allowed through the firewall.
As a result, Horizon Agent could not open required communication ports (TCP 4172, 8443, etc.) to the Connection Server, triggering the protocol initialization failure.

---

Resolution

1. Open Windows Defender Firewall → Domain Network Settings

2. Uncheck the option:
   “Block all incoming connections, including those in the list of allowed apps.”

3. Wait a few seconds, or restart the Horizon Agent service.

✅ After this change, the Horizon Agent status immediately switched to “Available.”

---

Verification

If you want to confirm this through logs:

Log Type	Location	Key Event IDs / Indicators
Firewall Policy Change	Event Viewer → Applications and Services Logs → Microsoft → Windows → Windows Firewall with Advanced Security → Firewall	Event ID 2004, 2005, 2033, 2034
Firewall Blocking Activity	Applications and Services Logs → Microsoft → Windows → Windows Defender Firewall → Operational	Event ID 5152, 5157 (blocked packets or connections)
Group Policy Updates	Applications and Services Logs → Microsoft → Windows → GroupPolicy → Operational	Event ID 8006, 8007
Horizon Logs	C:\ProgramData\VMware\VDM\logs\debug-*.log	Errors such as Error 10060, Socket connect failed

---

Recommended Preventive Actions

• Disable “Block all incoming connections” via GPO

  • Computer Configuration → Windows Defender Firewall → Domain Profile

• Ensure required ports are allowed:

  • TCP 4172, UDP 4172 (PCoIP)

  • TCP 8443 / 22443 (Blast)

  • TCP 32111 (USB Redirection)

  • TCP 9427 (RTAV)

• Add exclusions in EDR or antivirus for:

  • vmblastsvc.exe

  • wsnm.exe

  • vmware-viewagent.exe

---

Conclusion

This issue was not caused by VMware itself, but by an overly restrictive Windows Firewall configuration that prevented Horizon Agent from establishing its communication channels.
Once the firewall’s “block all inbound connections” setting was disabled, all affected VMs returned to a normal “Available” state without reinstalling the Agent.

---

Keywords: VMware Horizon, Horizon Agent, Protocol Error, Windows Firewall, Block All Incoming Connections, Event ID 7000, PASVC Service, LUFA Service, Blast, PCoIP, Connection Server