ERROR_FLT_ALREADY_ENLISTED (0x801F001B) Fix
A minifilter driver tried to re-enlist in a transaction it's already part of. Happens with backup software or anti-malware tools. The fix is simple.
Quick Answer (for the impatient)
Reboot. If the error returns, uninstall or update the filter driver that’s causing it — usually your backup software or antivirus. Don’t bother chasing registry fixes unless you’re sure the driver is orphaned.
What This Error Actually Means
When a minifilter driver (used by backup tools, antivirus, or file system monitors) tries to attach to a transaction it’s already enlisted in, the Filter Manager slaps you with ERROR_FLT_ALREADY_ENLISTED (0x801F001B). This is a resource conflict — the transaction context is stuck with two references from the same driver.
I see this most often with backup software like Acronis True Image or Veeam, or with older anti-malware drivers that don’t gracefully handle transaction rollbacks. The driver’s FltStartFiltering call happens twice, or a bug in the driver’s PrePrepare or Commit callback fires a duplicate enlistment.
Fix Steps — In Order
- Reboot first. Nine times out of ten, a clean boot clears the transaction context. If the error doesn’t come back, you’re done.
- Identify the offending driver. Open Event Viewer (
eventvwr.msc) and check the System log around the time of the error. Look for a source namedFltMgror a minifilter name. Also check the application logs for your backup/AV software. - Uninstall the latest update or the whole software. If it’s a backup agent or antivirus, uninstall it, reboot, and test. If the error disappears, contact the vendor — you need a driver update.
- Roll back the driver. Go to Device Manager > View > Show hidden devices. Expand
Non-Plug and Play Drivers. Find the filter driver (e.g.,acronis_flt.sysoravgflt.sys). Right-click > Properties > Driver > Roll Back Driver if available. - Disable the filter driver temporarily. Open an admin command prompt:
fltmc loadlists all minifilters. Find the one with a 0x801F001B error. Thenfltmc unload <filter_name>. Note: if the driver is required for boot, this might hang the system. Use with caution.
If the Main Fix Fails
Sometimes the driver is orphaned — uninstalled but its registry entry persists. That’s rare but real. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ and look for a key named after the driver (e.g., acronis_flt). Delete it only if you’re 100% sure the software is gone. Back up the key first — export it to a .reg file.
Another edge case: the TxF transaction itself is corrupt. Run fsutil resource setautoreset true C:\ on the affected volume. This resets the transaction resource manager. Downside — any uncommitted transactions on that volume are lost. Not ideal on a production server mid-backup.
Prevention
Update your backup and antivirus software quarterly. Don’t run two filter-heavy tools simultaneously — e.g., don’t have both Acronis and Veeam agents installed on the same server. That’s a recipe for exactly this kind of conflict.
Was this solution helpful?