STATUS_RXACT_STATE_CREATED (0X40000004) Fix Guide

Quick answer

Run fsutil resource query C: in an admin command prompt to see if there's a pending transaction. If yes, reboot twice – that's usually enough. If not, use logman stop to kill stale NTFS log sessions.

What's happening here?

This status code shows up in Event Viewer logs, Windows Update logs, or during driver debugging. It's part of the Registry Transaction (RXACT) system that Windows uses to batch changes to the registry or file system. Think of it as a pending commit – changes are staged but not written yet.

You'll most often see this after a failed Windows Update, a crashed system restore, or a sudden power loss during a registry write. It's not a crash itself – it's Windows telling you, "Hey, I have a transaction hanging out here, waiting." The real problem is that if another update or restore tries to start, it'll block because it sees an existing transaction.

On Windows 10 and 11, this code is typically logged with Source: Kernel-General or Microsoft-Windows-Kernel-TransactionManager. It's labeled as "Information" level, so don't panic. But if you're seeing it repeatedly, something's leaving transactions open.

Step-by-step fix

Open an elevated Command Prompt. Press the Windows key, type cmd, right-click Command Prompt, and choose "Run as administrator." Click Yes if UAC asks.
Check for pending transactions on your system drive. Type this and hit Enter:
```
fsutil resource query C:
```
After you run it, look for a line that says Pending Transactions. If it's 0, there's no transaction holding things up. If it's 1 or higher, you've got one or more stuck transactions.
If you see pending transactions, reboot twice. Restart your PC normally. Let it fully boot to the desktop. Then restart again. This forces Windows to clean up orphaned transactions during boot. After the second reboot, run the fsutil command again – the count should be 0.
If the count is still >0 after two reboots, close the transaction log session. Still in the admin command prompt, run:
```
logman stop -ets -n "NTFS Logging Session"
```
This kills the active NTFS log session, which forces transactions to abort. You'll see a message like "The command completed successfully." Then run the fsutil command again – the count should drop to 0 immediately.
Restart the NTFS Logging Session. After you're sure the pending count is 0, re-enable the logging session so Windows can manage transactions normally again:
```
logman start -ets -n "NTFS Logging Session" -o "%SystemRoot%\System32\LogFiles\NTFS\ntfslog.etl" -bs 256 -nb 16 8 -mode 0x2
```
You won't see a confirmation message – that's fine. Run fsutil resource query C: again to verify the count stays at 0.

Alternative fix: Use Disk Cleanup

Sometimes the pending transaction is from a stuck Windows Update or System Restore point. Run Disk Cleanup, select "Clean up system files," and check the boxes for "Windows Update Cleanup" and "System Restore and Shadow Copies." This deletes old restore points and update files that might be tying up the transaction. Wait – after cleaning, reboot once, then check with fsutil again.

Alternative fix: Disable and re-enable TxF

If nothing else works – and this is rare – you can disable Transactional NTFS (TxF) via the registry. Open Regedit, go to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

Find NtfsDisableTransaction. If it's not there, create a DWORD (32-bit) value with that name. Set it to 1 to disable TxF. Reboot. Then set it back to 0 and reboot again. This flushes all pending transactions. Only use this if you're comfortable editing the registry – and back it up first.

Prevention tip

The most common trigger for this error is interrupting a Windows Update or System Restore. Never force shutdown during updates. If an update seems stuck, wait at least 30 minutes before hitting the power button. Also, if you use disk cleanup tools like CCleaner, don't let them delete NTFS log files – those logs are what Windows uses to recover from crashes without leaving transactions dangling.

One more thing: if you're a developer and this shows up in your kernel debugging logs, you're probably looking at a driver that's creating transactions but not committing them. Check calls to NtCreateTransaction and NtCommitTransaction – you might be missing a commit path in your error handling.