ERROR_RESMON_INVALID_STATE (0x13DC): Fix & Why It Happens

You hit this error. Let's get it fixed in five minutes.

ERROR_RESMON_INVALID_STATE (0x000013DC) usually shows up when you're trying to start a performance monitoring tool — perfmon.exe, Resource Monitor (resmon.exe), or during a crash dump analysis in WinDbg. The error is saying the internal state machine of the Resource Monitor DLL has been corrupted. Here's what to do.

The Fix: Reset Resource Monitor State

Skip the system restore points and the SFC /SCANNOW nonsense. The real fix is to delete the Resource Monitor's persistent state file and restart the service. Here's the exact process.

1. Open an elevated Command Prompt. Press Win+X, choose 'Terminal (Admin)' or 'Command Prompt (Admin)'.
2. Stop the Performance Logs & Alerts service (this also stops ResMon):
   net stop pla
   If it's already stopped, you'll get a message saying so — that's fine.
3. Delete the corrupted state file. Run:
   del /f /q "%SystemRoot%\System32\perfmonBackup.xml"
   This XML file stores the last-known-good state of the Resource Monitor. When it gets corrupted (usually from a crash or blue screen), the state machine can't validate itself.
4. Restart the service:
   net start pla
5. Try your original operation again. Open Resource Monitor or perfmon. The error should be gone.

Why This Works

What's actually happening here is that resmon.dll (the Resource Monitor library) serializes its internal state to disk after every monitoring session. This file — perfmonBackup.xml — is supposed to let ResMon resume monitoring across service restarts without losing data. But if you had a kernel panic (BSOD), a power loss, or an abrupt shutdown while the file was being written, that XML gets left in an inconsistent state. The next time ResMon tries to deserialize it, the state machine checksums fail, and you get 0x000013DC.

The reason step 3 works is simple: deleting the file forces ResMon to start fresh, constructing its state from scratch rather than trying to parse a corrupted snapshot. No hex editing, no registry hacks, no third-party tools.

Less Common Variations

Sometimes the error isn't tied to an XML corruption. I've seen two real-world variants:

• Driver-induced corruption. Happens with old Broadcom network drivers (BCM57xxx series) on Windows 10 20H2 through 22H2. The driver's NDIS miniport hook interferes with ResMon's counter collection. Fix: update the driver to version 218 or later, or replace with a Microsoft inbox driver.
• Antivirus file locking. McAfee Endpoint Security (ENS) and older CrowdStrike versions have been known to hold an exclusive lock on perfmonBackup.xml during on-access scans. When ResMon tries to write to it simultaneously, the state gets truncated. Fix: exclude %SystemRoot%\System32\perfmonBackup.xml from real-time scanning, then delete and restart the service as above.

Prevention

Three things you can do to never see this error again:

1. Don't hard-reboot your machine while any performance monitor is open. If you must force a shutdown, close Resource Monitor first. It flushes state on exit.
2. Keep your network and storage drivers current. Outdated drivers are the #1 cause of the NDIS hook conflict that triggers this. Check at least quarterly.
3. If you use third-party security software, whitelist the ResMon state file. Add %SystemRoot%\System32\perfmonBackup.xml to the antivirus exclusion list. This avoids the file-lock race condition entirely.

That's it. Five minutes, one deleted file, zero reinstalls. You're good.