STATUS_INVALID_SYSTEM_SERVICE (0xC000001C) — What Actually Triggers It
This BSOD or app crash means a program called a system service that doesn't exist on your machine. Happens mostly after driver installs or bad registry edits.
You're working on a Windows Server 2019 box or a Windows 10 Pro machine, and suddenly you get a blue screen with STATUS_INVALID_SYSTEM_SERVICE (0xC000001C). Or maybe an app just crashes with that error code. The trigger is almost always something specific — you just installed a new network driver, updated a storage controller firmware, or ran a registry cleaner that went too far. I've seen it most often after installing a VPN client that bungles its kernel-mode service registration.
What's actually happening here is that a user-mode program or a kernel driver tried to call a system service (think of it as a numbered function in the Windows kernel) using a service ID that doesn't exist. The kernel doesn't recognize the number, so it says invalid system service
and either crashes the calling process or blue-screens the whole system. The fix isn't about repairing the kernel — it's about finding what called the wrong number and removing it.
Root Cause Explained
Windows uses a system service dispatch table — a big list of function pointers inside ntoskrnl.exe. Each service (like NtCreateFile or NtOpenProcess) has an index. When a driver or program calls syscall with an index that's out of bounds, you get 0xC000001C. This happens when:
- A third-party driver registers a new service index but the install gets corrupted (the driver's entry in
HKLM\SYSTEM\CurrentControlSet\Servicespoints to a missing file). - A registry cleaner deletes a service entry that a driver still expects.
- An anti-virus or backup tool's kernel filter driver has a version mismatch with the OS build.
The key point: the kernel itself is fine. The bug is in the service table entry's source.
Fix Steps
- Boot into Safe Mode — This bypasses most third-party drivers and services. If the error doesn't appear in Safe Mode, you've confirmed a driver or non-Microsoft service is the culprit. Hold Shift while clicking Restart, then go to Troubleshoot > Advanced Options > Startup Settings > Restart, then press 4 or F4.
- Check the dump file — In the BSOD, you'll see a driver name (like
badfilter.sysorvpnknock.sys). Use!analyze -vin WinDbg if you have it, or just read the stop code details. The failing driver name is your direct clue. Uninstall that driver from Device Manager or remove its service fromsc.exe delete <servicename>. - Run sfc /scannow — This checks system file integrity. Open an admin command prompt and run
sfc /scannow. If it finds corruption, it'll replace files from the local cache. This fixes cases where a Windows update partially overwrote a system service file. - DISM restore health — If sfc finds corruption it can't fix, run
DISM /Online /Cleanup-Image /RestoreHealth. This pulls fresh files from Windows Update. I've seen this fix the error on Server 2019 after a failed .NET update. - Check recently installed software — Use
dism /online /get-packagesto list updates, or look in Programs and Features for anything installed in the last week. Uninstall VPN clients, anti-virus suites, and hardware monitoring tools one at a time, rebooting after each. The goal is to find the service that registers the bad index. - Examine the registry service entries — Open regedit and go to
HKLM\SYSTEM\CurrentControlSet\Services. Look for any service whoseImagePathpoints to a file that doesn't exist. Delete those keys (backup first!). A missing image path means the service table entry has no backing driver, which can cause an invalid call. - Roll back the last Windows update — If the error started after Patch Tuesday, go to Settings > Update & Security > View update history > Uninstall updates. Remove the latest quality update. I've seen cumulative updates for Windows 10 22H2 break the
NtQuerySystemInformationservice index for some third-party drivers.
If It Still Fails
You've tried all that and the error keeps coming back? Then you're dealing with something deeper. Boot from a Windows installation media and run chkdsk /r on the system drive — a corrupted file system can mangle service table entries. If that doesn't help, try a repair install (in-place upgrade) using the same Windows version ISO. This resets all system services to default while keeping your apps and data. As a last resort, a clean install wipes the problem, but only do that if you've exhausted everything else — the error is almost always a driver or registry issue, not a broken kernel.
Was this solution helpful?