STATUS_NDIS_MULTICAST_NOT_FOUND (0XC023000B) Fix

Quick answer

Reinstall the network adapter driver or reset Winsock with netsh winsock reset and reboot. That usually clears the stale multicast address entry.

What's actually happening

This error pops up when an NDIS miniport driver tries to remove a multicast address from its filter list — but that address was never added in the first place. The driver's internal state machine got out of sync with the Windows network stack. You'll see this most often on Windows 10 22H2 or Windows 11 after a driver update, or when a VM (Hyper-V or VMware) loses its network adapter and the host tries to clean up multicast groups that no longer exist.

The error code 0xC023000B maps to STATUS_NDIS_MULTICAST_NOT_FOUND, defined in ntstatus.h. It's not a fatal OS crash — it's a warning logged in the System Event Log under source NDIS with Event ID 10016 or similar. But it can cause intermittent network drops, especially for apps using multicast protocols like WS-Discovery or mDNS.

Fix steps

1. Reboot first. Stupidly simple, works 60% of the time. The NDIS state resets on boot. If the error doesn't come back, you're done.
2. Reset Winsock catalog. Open PowerShell as admin and run netsh winsock reset, then netsh int ip reset. Reboot. This rebuilds the Winsock provider chain, which often clears mismatched multicast registrations.
3. Refresh the network bindings. In Network Adapter properties, uncheck everything under This connection uses the following items: except Internet Protocol Version 4 (TCP/IPv4), click OK, then re-check them. This forces the NDIS driver to re-enumerate its multicast filters.
4. Reinstall the network adapter driver. In Device Manager, right-click your adapter, choose Uninstall device, check Delete the driver software for this device, reboot, and let Windows reinstall the driver. For Realtek or Intel adapters, grab the latest driver from the OEM's site, not Windows Update — those signed drivers are often more stable.
5. Check for VM leftovers. If you removed a Hyper-V virtual switch or a VMware bridge, the host's NDIS stack might still hold a multicast reference. Run Get-VMSwitch in PowerShell and delete orphaned switches with Remove-VMSwitch -Name. Then reboot.

Alternative fixes if step 3 fails

If the main steps don't kill the error, the problem is probably a third-party NDIS filter driver — like antivirus, VPN clients, or firewall software. Disable all non-Microsoft network services via msconfig (selective startup) and reboot. If the error disappears, you've found the culprit. Re-enable one service at a time to isolate it. I've seen NordVPN and McAfee personally cause this exact 0xC023000B error on Windows 11 23H2.

Another dirty fix: disable IPv6 on the adapter. Go to adapter properties, uncheck Internet Protocol Version 6 (TCP/IPv6), reboot. Some NDIS drivers handle IPv6 multicast poorly. This isn't ideal — IPv6 is kinda important — but it works as a diagnostic step.

Prevention tip

Keep your NIC driver and Windows updated together. Don't mix drivers from Windows Update with OEM drivers from 2019 — that's how the state machine gets confused. If you run Hyper-V, use Set-VMNetworkAdapter -MacAddressSpoofing On only when needed; MAC spoofing can trigger multicast filter drift.

And if you're seeing this error regularly, run netsh trace start persistent=yes for 24 hours, then netsh trace stop. Analyze the ETL file with Network Monitor or Wireshark — you'll see exactly which driver is mismanaging multicast addresses.