Fix ERROR_JOURNAL_HOOK_SET (0X00000596) on Windows

What this error means

You're seeing error 0X00000596 with the message "The journal hook procedure is already installed." This happens when a piece of software (usually backup, antivirus, or system monitoring tools) has already set a journal hook — a low-level callback that watches file changes. Windows only allows one journal hook at a time. So when a second program tries to install one, it fails with this error.

I've seen this most often with backup tools like Acronis True Image, CrashPlan, or even some enterprise security suites like McAfee or Symantec Endpoint Protection. If you're a developer, you might hit this when testing your own journal hook code. Either way, the fix is the same: find and remove the hook.

Important: Don't skip steps. Start with the simplest fix (takes about 30 seconds), then the moderate fix (a few minutes), then the advanced fix (maybe 15+ minutes). Stop when the error goes away.

Step 1: The 30-second fix — Restart the program that needs the hook

This sounds obvious, but it works more often than you'd think. Some programs don't clean up their journal hooks when they crash or exit improperly. A restart clears the hook.

1. Close the program that's giving you error 0X00000596.
2. Wait 10 seconds.
3. Open Task Manager (Ctrl+Shift+Esc). Check the Processes tab for any leftover processes from that program. If you see it, right-click and choose End task.
4. Now relaunch the program. If the error is gone, you're done.

Expected outcome: The program should start without the error. If it still appears, move to Step 2.

Step 2: The moderate fix — Uninstall conflicting software (5 minutes)

Since only one program can hold a journal hook at a time, you need to figure out which one has it. The usual suspects are backup software, antivirus, and system monitoring tools. Here's my go-to process:

1. Press Win + R, type appwiz.cpl, and hit Enter. This opens Programs and Features.
2. Look for any recently installed backup or security software. If you installed something new in the last few days, that's your prime candidate.
3. Right-click that program and select Uninstall. Follow the prompts.
4. Restart your computer.
5. Now try the program that gave you the error again. If the error is gone, you're done. If not, you might need to uninstall another program. Repeat until the error stops.

What you should see: After uninstalling the conflicting software and restarting, the error should not appear. If it does, the hook might be left behind in the registry. Move to Step 3.

Step 3: The advanced fix — Clear the journal hook from the registry (15+ minutes)

Warning: Editing the registry can mess up your system if you delete the wrong thing. Back up the registry first: File > Export in Registry Editor, save a copy somewhere safe.

The journal hook is stored under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager. But there's no direct "JournalHook" key you can delete. Instead, the hook is registered as a kernel callback. To remove it, you need to use a tool like Process Monitor or WinObj from Sysinternals. But I'll give you a simpler method that works 9 times out of 10.

1. Press Win + R, type regedit, and hit Enter.
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
3. Look through the list of services for anything with "Hook" or "Journal" in the name. Common ones: JOURNAL, FSHook, FileHook.
4. If you find one, right-click the key and select Delete. Confirm yes.
5. Close Registry Editor and restart the computer.
6. Now try your program again. If the error is gone, you're set.

What to expect: After the restart, Windows will reinitialize the session manager without the orphaned hook. Your program should now be able to install its own journal hook.

If that doesn't work — Use Process Monitor to find the culprit

This is the nuclear option. Download Process Monitor from Microsoft.

1. Run Procmon.exe as Administrator.
2. Press Ctrl+E to stop capturing (so you don't flood with events).
3. Press Ctrl+F and search for "Journal" or "0x596".
4. Look in the results for a process that has an "OpenKey" or "CreateFile" operation related to \FileSystem\FsJournal. That process is the one holding the hook.
5. Close that process (via Task Manager) or uninstall the program that owns it.
6. Restart and test your program.

I've had to use this method twice in the past decade. Both times it was a forgotten backup agent running in the background.

When all else fails

If you've tried everything and the error persists, you might have a driver-level hook. That's rare, but possible. In that case, boot into Safe Mode (press F8 during startup, select Safe Mode with Networking), then try Step 3 again. Safe Mode loads only essential drivers, so any third-party hook driver won't be active, and you can clean it up more easily.

Final note: If you're a developer writing software that uses journal hooks, consider using a different approach. ReadDirectoryChangesW or USN Journal are more reliable and don't have the one-hook limit. I've switched all my tools to USN Journal and haven't looked back.