Fix 0x00000126: FsFilter Operation Completed Error
This error pops up when a file system filter driver finishes an operation but Windows logs it oddly. Usually caused by antivirus or backup software hooks.
When You'll See This Error
You're staring at a blue screen or a system log entry with STATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY and code 0x00000126. This usually happens right after you install something that hooks deep into the file system — think antivirus software like McAfee or Norton, or a backup tool like Acronis True Image. I had a client last month whose Lenovo laptop started throwing this error every time Windows booted, right after Bitdefender auto-updated. The weird part? It says "completed successfully" but still triggers a crash or a warning in Event Viewer under System logs with source 'FilterManager'. You're not crazy — it's a real pain point.
What Actually Causes It
The root cause is simple: a file system filter driver (like a mini-filter driver from antivirus or backup software) finishes an I/O operation, but the way it reports back to Windows triggers a false positive or a race condition. The driver itself thinks it's fine, but the system's filter manager sees the status code and either logs it as an error or, in worse cases, blue-screens because of conflicting filter stacks. Common culprits are:
- Third-party antivirus with real-time scanning (especially ones that replace Windows Defender)
- Backup software that uses volume shadow copy or file-level snapshots
- Encryption tools like VeraCrypt or BitLocker third-party add-ons
- Old or corrupted filter drivers from uninstalled software that left remnants
In my experience, 9 out of 10 times it's an antivirus mini-filter driver that's either outdated or conflicting with a Windows update. Microsoft's own Filter Manager logs this code when the driver finishes without error, but the system misinterprets it under certain conditions — like when the driver's altitude (priority level) overlaps with another filter.
The Fix: Remove or Update the Problem Driver
Skip the generic "run SFC" advice. That won't touch filter drivers. Here's what actually works:
Step 1: Identify the Culprit Driver
Open Command Prompt as Administrator and run:
fltmc instancesThis lists all active file system filter drivers. Look for anything from a third-party vendor. Common suspects: BHDrvx64.sys (Bitdefender), SymEFASI.sys (Symantec), snapman.sys (Acronis). Note the exact driver name and its altitude number.
Step 2: Check Which Software Owns It
Run driverquery to see the full driver list, then cross-reference the filter driver name. Or use Autoruns (from Sysinternals) — go to the 'Filters' tab. That shows you every filter driver with its vendor. I always use Autoruns because it's faster and shows disabled ones too.
Step 3: Disable or Uninstall the Offending Software
If it's antivirus: temporarily disable real-time protection, then uninstall it completely using the vendor's removal tool (e.g., McAfee Consumer Product Removal tool, Norton Removal Tool). A normal uninstall often leaves the filter driver behind. Had a client who used Windows' built-in uninstaller for Norton, but the filter driver stayed and caused this exact error for weeks.
For backup software: uninstall it, then reboot. Some tools like Acronis have a cleanup utility — use that. Don't just delete the folder.
Step 4: Remove Orphaned Filter Drivers
If the software is gone but the driver remains, you'll need to delete it manually. Boot into Safe Mode (hold Shift while clicking Restart, then Troubleshoot > Startup Settings). Open Registry Editor and go to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Find the key that matches the driver name (e.g., BHDrvx64). Delete it. Then delete the .sys file from C:\Windows\System32\drivers\. Reboot normally.
Step 5: Reinstall Windows Defender (If You Killed It)
After removing third-party AV, make sure Windows Defender is active. Run Get-Service WinDefend in PowerShell. If it's not running, start it with Start-Service WinDefend. Then run a quick scan.
If It Still Fails
Check your Windows version and update it fully. A Windows 10 22H2 or Windows 11 23H2 cumulative update fixed a bug where FilterManager mislogged this code — apply all pending updates. Also run chkdsk /f on your system drive to rule out disk corruption. If none of that works, open Event Viewer, go to Windows Logs > System, filter by source 'FilterManager', and look for the exact driver altitude that's failing. Share that altitude (like 320000) with the vendor's support — they'll know which driver it is. And honestly, sometimes the only clean fix is a wipe-and-reload if you've got too many filter drivers stacked up from years of installations.
Was this solution helpful?