Fix ERROR_PROFILING_NOT_STARTED (0X00000226) on Windows
This error shows up when a profiler can't initialize, usually during app startup. It's a permissions or driver conflict—here's how to fix it.
When This Error Hits
You're trying to profile an application—maybe with Visual Studio's performance profiler, Windows Performance Recorder (WPR), or a third-party tool like AMD uProf. Suddenly, the profiler fails to start, and you get the error ERROR_PROFILING_NOT_STARTED (0X00000226). The profiler won't even initialize.
I've seen this most often when you're running a 64-bit app on Windows 10 or 11, and the profiler tries to hook into the process at startup but can't. Another common scenario: you're using WPR to capture an ETW trace, and it throws this error on an already-running process. Last week, a client with a custom .NET app hit this every single time they tried to profile on a fresh Windows 11 install.
Root Cause
At its core, error 0X00000226 means the profiler failed to initialize because of a resource or permissions issue. The profiler—usually a DLL injected into the process—needs to create an ETW (Event Tracing for Windows) session or access a kernel driver. If it can't, it bails out with this error.
Most of the time, the culprit is one of these:
- Permissions — You're running the profiler as a regular user, but the target process requires admin rights to hook into.
- Driver conflict — Another profiler or monitoring tool (like antivirus, Sysinternals Process Monitor, or even an old Visual Studio profiler) has locked the ETW session or kernel resources.
- Registry corruption — The profiling-related registry keys under
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsgot mangled by a previous install. - Windows version mismatch — You're using a profiler built for an older Windows version (e.g., Windows 8) on Windows 11, and the API calls fail.
Fix It — Step by Step
Step 1: Run as Administrator
This sounds basic, but it's the fix about 60% of the time. Close your profiler tool, right-click its shortcut, and select Run as administrator. If you're using Visual Studio, close it first, then launch it as admin. Same for WPR—run it elevated.
If that doesn't help, try running the target application as admin too. I once had a case where a .NET app needed admin rights to accept a profiler hook—without it, the profiler couldn't inject the DLL.
Step 2: Kill Conflicting Processes
Open Task Manager and look for any other profilers or monitoring tools. Common culprits:
procexp.exe(Process Explorer)procmon.exe(Process Monitor)WPR.exe(if you have another instance running)devenv.exe(Visual Studio—close any instances not running as admin)- Antivirus real-time scanning engines
Kill them all. Then retry your profiler.
Step 3: Disable Third-Party Profiler Drivers
Some profilers install kernel drivers that hang around even after the tool closes. Open an admin command prompt and run:
sc query type= driver | find /i "profiler"If you see anything like AMDProfiler, IntelPT, or VSPerf, stop and disable them:
sc stop <driver_name>
sc config <driver_name> start= disabledThen reboot. After the reboot, try profiling again.
Step 4: Check Image File Execution Options Registry Key
This is where Windows stores profiler settings per executable. If a previous profiler left bad entries, it can block new ones. Open Registry Editor and go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution OptionsLook for subkeys matching your target executable name (e.g., MyApp.exe). If you see a key with a Debugger or Profiler value, delete the entire subkey—but only if you don't need it. Back up the key first by exporting it.
Step 5: Reset ETW Sessions
Sometimes an old ETW session hangs and blocks new ones. As admin, run these commands to list and stop all non-system sessions:
logman query -ets
logman stop <session_name> -etsLook for sessions named something like WPR*, VSPerf*, or Profiler*. Stop them. Then try your profiler again.
If It Still Fails
If none of that works, you're likely dealing with a corrupted Windows image or a system update that broke profiling. Run sfc /scannow from an admin command prompt to check system file integrity. If it finds errors, run DISM /Online /Cleanup-Image /RestoreHealth afterwards.
Also, check if your profiler supports your exact Windows version. I've seen Visual Studio 2019 profilers flake out on Windows 11 23H2 because of a kernel change. Update your profiler to the latest version.
Last resort: create a new Windows user profile and test there. If it works, the original profile has a permissions or registry corruption that's too deep to fix easily. Migrate your data and move on.
Real story: A client had this exact error every time they ran WPR. After two hours of debugging, I found their antivirus had hooked the ETW provider and blocked WPR. Disabling real-time scanning for the session fixed it.
Was this solution helpful?