Fix ERROR_LUIDS_EXHAUSTED (0X00000536) on Windows

Quick Answer for Advanced Users

Reboot the machine, then run tasklist /v and look for processes with abnormally high handle counts. Kill them with taskkill /f /pid. If it keeps happening, check Event Viewer for a driver or service leaking LUIDs.

What This Error Means

LUID stands for Locally Unique Identifier. Windows uses them internally for things like security tokens, kernel objects, and COM interfaces. Each LUID is a 64-bit number that's guaranteed to be unique on that machine until reboot. When your system runs out — meaning the LUID pool is exhausted — you get ERROR_LUIDS_EXHAUSTED (0X00000536). This almost never happens under normal load. The culprit is almost always a buggy driver, a hung service, or a piece of software that's requesting LUIDs in a tight loop without releasing them. Think of it like a handle leak, but with LUIDs.

I've seen this most often on Windows Server 2016 and 2019 running third-party antivirus or backup software that hooks into the kernel. Also happens on workstations with certain VPN clients or virtual machine monitor software (like VMware Workstation). The error usually pops up when you try to start a service, open a file, or launch an application — suddenly it fails with that hex code.

Fix Steps (In Order)

Reboot the system. This resets the LUID pool entirely. If the error goes away after a reboot, you're dealing with a leak that takes time to build up. If it comes back immediately, you've got a persistent leak.
Check for high handle counts. Open Task Manager (Ctrl+Shift+Esc), go to the Details tab, and sort by the Handles column descending. Look for anything with handle counts above 10,000. That's a red flag. Note the PID.
Kill the offending process. If you spot a suspicious process (especially one you don't recognize or a third-party tool), right-click and choose End task. Or from an admin command prompt:
```
taskkill /f /pid 1234
```
Replace 1234 with the actual PID.
Check Event Viewer. Open Event Viewer (eventvwr.msc), go to Windows Logs > System. Look for any errors or warnings with source like “LUID” or “Kernel-General”. Double-click them — they often include the process that caused the exhaustion. Google that process name plus “LUID leak”.
Update or rollback drivers. If you recently installed a new driver (network, video, or storage), try rolling it back. Go to Device Manager, find the device, right-click > Properties > Driver > Roll Back Driver. If that's not an option, download the latest from the manufacturer's site — not Windows Update.

Alternative Fixes (If the Main One Fails)

Disable unnecessary services. Run services.msc and look for third-party services that might be leaking LUIDs. Common culprits: backup agents, endpoint protection, and hardware monitoring tools. Stop them one by one and test.
Run a clean boot. Use msconfig to disable all non-Microsoft services and startup items. Reboot. If the error stops, re-enable services in batches until you find the offender.
Check for memory pressure. LUID exhaustion often correlates with low non-paged pool memory. Open Resource Monitor (resmon.exe), go to the Memory tab, and look at the “Non-paged pool” graph. If it's steadily climbing or maxed out, you have a memory leak — likely from the same driver or service that's eating LUIDs.
Use Process Monitor. For the brave: download Process Monitor from Sysinternals. Filter by Operation contains “LUID” or “AllocateLocallyUniqueId”. Capture events right before the error. You'll see which process is hammering the API.

Prevention Tips

Keep your system updated. Microsoft fixed several LUID leak bugs in later cumulative updates for Windows 10 and Server 2016/2019. Make sure you're fully patched.
Avoid software that hooks deep into the kernel. Especially old versions of VPN clients, third-party firewalls, and disk encryption tools. Stick with well-known vendors and keep them updated.
Monitor handle counts and non-paged pool usage. Set up a simple performance monitor (perfmon.msc) alert for the “Handle Count” counter. If it exceeds 50,000 across the whole system, investigate.
Don't ignore it. If you see this error only once after a reboot, fine. If it recurs, treat it like a ticking time bomb. The leak will eventually crash the machine or cause other weird errors (like random application crashes).