0XC0000720: Threadpool Callback Left Background Priorities Set

You're looking at a bugcheck with code 0XC0000720 — STATUS_CALLBACK_RETURNED_PRI_BACK. The Windows threadpool scheduler is angry because a worker thread entered a callback, ran it, and then exited without restoring the CPU priority settings to what they were before the callback. Specifically, it left the thread with background priority flags still active.

What's actually happening here is a contract violation. Windows threadpool worker threads are shared resources. When a callback runs, it's expected to leave the thread in a clean state — same priority, same background mode. If some piece of code inside that callback called KeSetPriorityThread or KeEnterBackgroundThread and didn't undo it, Windows flags this as a fatal bug. This isn't a user-mode crash you can shrug off. It's a 0xC0000720 bugcheck, which means the system halts.

1. Third-Party Antivirus or Security Software

This is the most common cause. Antivirus products — especially ones that hook into kernel thread scheduling — sometimes leave a thread in a background priority state after scanning a file or checking a network packet. I've seen this with old versions of McAfee, Symantec, and some lesser-known endpoint protection tools. The fix is straightforward: uninstall the security software completely, reboot, and see if the bugcheck stops.

Steps to fix

1. Boot into Safe Mode with Networking. Hit F8 during startup (or hold Shift while clicking Restart in the sign-in screen).
2. Open Control Panel → Programs and Features. Uninstall your third-party antivirus.
3. Use the vendor's dedicated removal tool (e.g., McAfee Consumer Product Removal tool, Avast Clear) to nuke leftovers. Normal uninstallers often leave drivers behind.
4. Reboot normally. If the system stays stable, you've found the culprit.

The reason step 3 matters is that antivirus installs kernel-mode drivers and minifilters. A plain uninstall might leave the driver registered and still active. The removal tool scrubs those registry entries and deletes the driver files.

# Example: Check for leftover AV drivers with driverquery
 driverquery /v | findstr /i "avast avira mcafee symantec"

If you see any listed, that driver is still loaded. Don't rely on Windows Defender — it doesn't cause this bug.

2. Corrupted or Incompatible Graphics Drivers

Graphics drivers, especially from NVIDIA and AMD, sometimes register threadpool callbacks for background rendering tasks. If the driver's internal state machine gets confused — say, during a suspend/resume cycle or a monitor hotplug — it can forget to restore priority. I've seen this on Windows 10 build 19044 and Windows 11 22H2 with certain NVIDIA Game Ready drivers (versus Studio drivers).

Fix: Clean reinstall of graphics driver

1. Download Display Driver Uninstaller (DDU). Run it in Safe Mode.
2. Select "Clean and restart" for your GPU vendor. This nukes every trace — registry, driver store, leftover files.
3. After reboot, install the latest stable driver from your GPU vendor's site. Skip beta versions.
4. Do a custom install and check "Perform Clean Installation" if offered.

What's happening technically: DDU removes the driver's kernel-mode components that register the threadpool callbacks. A clean install forces Windows to rebuild the driver's callback registrations from scratch, which often clears the stale state that caused the priority leak.

If the bugcheck only happens during gaming or video playback, this is your most likely fix. If it happens at idle or during normal desktop use, go back to cause #1.

3. Unpatched System or Known Bad Third-Party Driver

Sometimes the bug is in a third-party driver that isn't antivirus or graphics. Common offenders: virtual audio drivers (like those from Creative Labs or Realtek), VPN tunnel adapters, or hardware monitoring tools (HWMonitor, AIDA64). These drivers can register threadpool callbacks for monitoring or control operations and mess up the priority.

Diagnose with Driver Verifier

Driver Verifier is a built-in Windows tool that stresses drivers and catches contract violations like this one. Use it only if you're comfortable with potential boot loops — you'll need to enter Safe Mode to disable it.

# Open command prompt as admin
 verifier /rule 0x8 /flags 0x200  # Specifically checks for threadpool priority violations

Set it to test unsigned drivers or all third-party drivers. Reboot. If the system crashes faster and points to a specific driver file (e.g., cmaudio.sys or rtkfilter.sys), that's your culprit. Uninstall the associated software.

The reason this works: Driver Verifier injects extra checks into driver code paths. When a driver violates the threadpool callback contract, Verifier catches it and writes the driver's name to the crash dump instead of a generic 0xC0000720.

Windows Update

Microsoft has released fixes for threadpool priority handling in cumulative updates. Install all pending updates — especially KB5034441 (Jan 2024) and later, which included scheduler reliability improvements. Go to Settings → Windows Update → Check for updates. Install everything, reboot, retry.

Quick-Reference Summary

One last thing: if you're running Windows Server (especially 2019 or 2022 with Hyper-V roles), check for outdated Broadcom network drivers. They had a known issue with threadpool callbacks leaving background priority set during VM live migration. Update them from the hardware vendor directly — never from Windows Update for network drivers on servers.