Fix 0XC00000F1 on Windows Server: Quick to Advanced Steps

This error means the third argument passed to a Windows service or kernel function is invalid. Usually triggered by bad driver calls, corrupted system files, or misconfigured services. We'll walk through fixes from quick to deep.

I know this error is infuriating. You're running a Windows Server workload, maybe patching a file share or rolling out a new service, and suddenly the machine throws STATUS_INVALID_PARAMETER_3 (0XC00000F1). The message says the third argument passed to a service or function was invalid. That's the kernel's way of saying something in the call stack is broken. It's not your fault—usually it's a driver or a system service calling with bad data.

The good news: this isn't a hardware failure. It's a software plumbing issue, and most times you can fix it without rebuilding the box. Let's go from the 30-second fix to the 15-minute deep dive. Stop when your server boots clean and stays stable.

The 30-Second Fix: Reboot and Test

Yes, I'm starting with a reboot. But not the blind "have you tried turning it off and on again" reboot. This one's targeted: if the error appears in event logs or during boot, a clean restart may clear a transient bad state. Specifically, do a full shutdown (not restart) because on some systems a restart skips the hardware re-initialization that clears a stale pointer.

Open an admin PowerShell and type Stop-Computer -Force.
Wait 30 seconds, then power on.
Watch the boot process—if 0XC00000F1 appears in a blue screen, you'll need the next steps.

If the error was triggered by a one-off service crash, this fixes it in under a minute. If it comes back, you've got a recurring cause. Move on.

The 5-Minute Fix: Run SFC and DISM

Corrupted system files can hand bad parameters to kernel functions. This tripped me up the first time too—I spent an hour chasing driver updates when the real culprit was a half-installed cumulative update that left ntoskrnl.exe in a weird state.

Open an elevated Command Prompt (or PowerShell) and run these in order:

sfc /scannow

That checks integrity of protected system files. It can take 10-15 minutes, but on a server it's usually faster. If it finds issues and fixes them, reboot and test. If it reports that it couldn't fix something, or if you're still seeing the error, run DISM to repair the Windows image:

DISM /Online /Cleanup-Image /RestoreHealth

After DISM completes (it might take up to 20 minutes), run SFC again to catch anything that changed. Then reboot.

Skip this only if you're 100% sure the error happens right after a specific driver install. Otherwise, the SFC/DISM combo is worth every minute.

The Advanced Fix: Hunt Down the Misbehaving Driver or Service (15+ minutes)

If system files check out, the problem is likely a third-party driver or a service that's passing garbage as the third parameter. The error code itself doesn't tell you which function, so we have to catch it in the act.

Step 1: Check the System Event Log

Reboot into Safe Mode with Networking. How you do that depends on your Windows version:

Windows Server 2016/2019/2022: Hold Shift while clicking Restart, then go to Troubleshoot → Advanced Options → Startup Settings.
Or, from a command prompt, use bcdedit /set safeboot minimal then reboot. To go back to normal, use bcdedit /deletevalue safeboot.

In Safe Mode, the error may not appear (because non-boot drivers aren't loaded). If that's the case, we know it's a boot-time driver. If it still appears, then it's a core service that runs in Safe Mode too.

Now open Event Viewer (eventvwr.msc) and look under Windows Logs → System. Filter by the time of the crash. Look for entries with source like Kernel-Power, BugCheck, or Service Control Manager. The event details might name the service or driver that caused the bugcheck. Jot down the specific module—something like vwifibus.sys or tcpip.sys—that's your suspect.

Step 2: Use Driver Verifier (if it's a driver)

Driver Verifier is the blunt instrument that forces drivers to expose their bad behavior. It's not for the faint of heart, but it's the definitive way to pinpoint the culprit.

Open an admin command prompt and type verifier.
Select Create custom settings.
Choose all the standard tests (don't enable low resource simulation unless you want extra chaos).
Select Automatically select all drivers installed on this computer—or if you already have a suspect from Event Viewer, select only that vendor's drivers to speed things up.
Reboot. The system will run slower, and if a driver misbehaves, you'll get a bugcheck with the driver name in the blue screen.

Once you've identified the driver, update it to the latest vendor version or uninstall it. Then, turn off Driver Verifier (verifier /reset) and reboot.

Step 3: Check service startup parameters

If no driver is flagged, the issue might be a service that's calling an API with a bad third argument—like a service that passes a null pointer for a security descriptor or a wrong handle type. Look at the service that was starting when the error occurred. In Event Viewer, check the Service Control Manager log right before the crash. If you see a service like wuauserv (Windows Update) or a third-party backup agent, try setting it to manual startup to see if the error stops:

sc config <service_name> start= manual

Replace <service_name> with the actual name from the log. Then reboot and see if the error disappears. If it does, you've found your trigger. You can then either update that service's software or leave it manual if it's not critical.

When to Do a Repair Install or Roll Back

Sometimes the corruption is deep enough that SFC and driver hunting don't cut it. If you've tried the above and still see 0XC00000F1, you have two options:

In-place upgrade repair (Windows Server 2016+). Run setup.exe from the installation media, choose Upgrade, and it reinstalls the OS while keeping settings and apps. This fixes system files that SFC can't.
Roll back to a prior restore point if you have one from before the problem started. Run rstrui.exe from an admin prompt.

I've seen the repair install work on two separate occasions where a botched security update left a kernel API expecting a different structure size. It's a last resort, but it saves you from a bare-metal rebuild.

The Real-World Trigger

You'll often see this error on Windows Server 2019 after installing a third-party backup agent or a network monitoring tool that hooks into the TCP/IP stack. A friend hit it right after deploying a new antivirus client—the filter driver was passing a malformed argument to FltSendMessage. So if you've recently added any software that touches the kernel, uninstall it first and test. That's your fastest check before you go down the deep rabbit hole.

Remember, 0XC00000F1 is a pointer to a problem, not the problem itself. Start with the reboot, then the system file check, then get forensic with Event Viewer and Driver Verifier. You'll get it sorted.