Fix CERTSRV_E_ALIGNMENT_FAULT 0x80094010

You're staring at a server crash with 0x80094010. It's frustrating, I know. Let's get it fixed.

This error means the Certificate Services process hit a memory alignment fault. On x64 systems, unaligned memory access causes an exception. The real fix is almost always a bad driver or faulty RAM. Here's the exact sequence to follow.

The Fix: Step by Step

1. Boot into Safe Mode
   Restart the server. Press F8 repeatedly before Windows loads. Select "Safe Mode with Networking." After it boots, you should see a lower resolution and fewer services running. This isolates the issue from most drivers.
2. Run Windows Memory Diagnostic
   Press Win+R, type mdsched.exe, hit Enter. Choose "Restart now and check for problems." The test will run for about 30 minutes. If you see red or error messages, your RAM is bad. Replace the faulty stick immediately.
3. Check for bad drivers
   Open Device Manager (Win+X, select Device Manager). Look for any device with a yellow exclamation mark. Right-click and update driver. Pay special attention to the network adapter and storage controller drivers—they're the most common culprits for alignment faults.
4. Update Certificate Services
   Run Windows Update. Install all security patches. A known bug in old versions of AD CS (Active Directory Certificate Services) can trigger this error. The update from KB5001401 fixed this for many users.
5. Test with the system in clean boot
   Press Win+R, type msconfig, hit Enter. Go to Services tab, check "Hide all Microsoft services," click "Disable all." Go to Startup tab, click "Open Task Manager," disable all startup items. Restart. If the error goes away, re-enable services one by one until it returns.

After each step, try starting Certificate Services with net start certsvc from an admin command prompt. If it starts without error, you're good.

Why this works

The 0x80094010 error isn't random. It's a hardware-level exception. The CPU expects data at a memory address that's a multiple of its natural word size—usually 4 or 8 bytes. When a driver or a buggy piece of software writes data to a misaligned address, the CPU throws a fault. Certificate Services is sensitive to this because it does a lot of low-level memory operations when processing certificate requests.

Most of the time, it's a network card driver that's doing DMA (direct memory access) writes to a misaligned buffer. Updating that driver fixes it. When it's not the driver, it's a faulty RAM module that's corrupting data at the hardware level. The Memory Diagnostic catches that.

I've seen this happen most often after a Windows Update replaced a driver or after someone added a new network card to the server. The error shows up during peak hours when the certificate service is processing a lot of requests.

Less common variations of the same issue

Virtualized certificate servers

If you're running AD CS on a VM (Hyper-V or VMware), the guest's virtual network adapter can cause this. Update the integration services or VMware Tools first. If that doesn't work, try switching from a VMXNET3 adapter to an E1000E in VMware, or from a synthetic adapter to a legacy adapter in Hyper-V. The older adapter types handle DMA differently.

Third-party antivirus or backup software

Some backup agents that interact with Volume Shadow Copy Service (VSS) can cause alignment faults during certificate backups. Temporarily disable your backup software's VSS provider. If the error stops, update or replace that software. I've seen this with older versions of Symantec Backup Exec and Veeam.

Corrupted certificate database

Rare, but possible. If hardware checks pass, back up the database files at %windir%\system32\certsrv\database and run esentutl /p on each .edb file. This repairs Jet database corruption. After repair, restart the service and check for errors.

Prevention going forward

• Enable Driver Verification — Run verifier.exe from an admin command prompt. Select "Create custom settings," then "Select driver names from a list." Check all non-Microsoft drivers. This will catch bad drivers before they crash your server.
• Run memory tests monthly — Schedule a Windows Memory Diagnostic after each Patch Tuesday. Use the built-in task scheduler to trigger a reboot and test.
• Keep a baseline of working drivers — Before you update a driver, save the current version's inf file from %windir%\inf and note the version number in your records. If the new driver causes problems, you can roll back quickly.
• Test driver updates on a non-production server first — This error is intermittent. It might not show up for days. Don't push driver updates to your production CA server without a week of testing.

Pro tip: If you're still stuck, look at the System event log under Event ID 50 or 51. Those events often point directly to the misbehaving driver. The error source will show the device name.