Fix STATUS_XMLDSIG_ERROR (0XC000A084) Fast – No BS

Yeah, this one’s a pain. Let’s fix it.

You’re staring at a blue screen or an app crash with 0XC000A084. That’s STATUS_XMLDSIG_ERROR – Windows couldn’t validate an XML digital signature on a file. Usually happens after a failed update, a corrupted driver, or when a signed catalog file (.cat) gets borked. I’ve seen it most often on Windows 10 22H2 and Windows 11 after a botched .NET update or a third-party antivirus nuking a system file.

The fix that works 9 times out of 10

Don’t bother with SFC /scannow first – it rarely touches catalog files. DISM is better, but the real culprit here is almost always a corrupted Windows security catalog (the one that stores digital signatures). Here’s the direct fix:

Boot into Safe Mode with Networking. Mash F8 or Shift+Restart from the login screen, then Troubleshoot → Advanced Options → Startup Settings → Restart → hit 4. Or use a Windows installation USB: language select → Repair your computer → Troubleshoot → Command Prompt.
Once in Safe Mode, open an elevated Command Prompt (Admin).
Run this to stop the Windows modules installer service from locking files:

net stop wuauserv
net stop bits
net stop cryptsvc

Now blow away the corrupted catalog database:

ren %systemroot%\System32\catroot2 catroot2.old

Restart the services you stopped:

net start cryptsvc
net start bits
net start wuauserv

Reboot normally. Windows rebuilds catroot2 on boot – it’ll pull fresh catalogs from Windows Update or the local driver store.

That’s it. Nine times out of ten, the error disappears. If it doesn’t, move to the next section.

Why this works

The catroot2 folder holds all the .cat files (security catalogs) Windows uses to verify digital signatures on drivers, DLLs, and system binaries. When a catalog gets corrupted – say from a power loss during a .NET update or an AV tool like McAfee locking a file mid-write – the XML digital signature inside gets mangled. Windows can’t parse it, so it throws 0XC000A084. Deleting catroot2 forces Windows to regenerate those catalogs from scratch. It’s safe – they’re cached and recreated automatically.

I’ve also seen this error when a specific signed binary gets trashed. In that case, the fix above won’t help because the problem isn’t the catalog – it’s the file itself. More on that in a sec.

Less common variations

Corrupted driver store

If the error pops up during boot or driver installation, a signed .sys or .dll file might be corrupt. Run this:

dism /online /cleanup-image /restorehealth
sfc /scannow

If SFC finds corrupt files but can’t fix them, check the CBS.log at C:\Windows\Logs\CBS\CBS.log for the specific file. You might need to replace it manually from a good copy (e.g., from a working machine on the same update level).

Third-party antivirus interference

Bitdefender, Norton, and even Windows Defender (if tampered with) have been known to quarantine signed catalog files. Check your AV’s quarantine for anything named ntdll.dll, kernel32.dll, or any .cat file. Restore them. Then add the entire C:\Windows\System32\catroot2 folder to your AV exclusion list.

Update history corruption

If the error appears right after a Windows update, the update itself may have a bad catalog. Uninstall the latest update:

wusa /uninstall /kb:XXXXXXX /quiet /norestart

Substitute the KB number from the update history. Then run the catroot2 fix above.

File-specific signature mismatch

Rare but happens. Use ProcMon (Process Monitor) from Sysinternals – filter for “0XC000A084” or “ACCESS DENIED” on .cat files. Find the exact file that’s failing. Then grab a fresh copy from a known-good machine or from the Windows installation media’s sources\install.wim.

How to avoid this in the future

Don’t force shutdown during updates. Ever. That’s the #1 cause of catalog corruption.
Keep your AV exclusions sane. Exclude C:\Windows\System32\catroot2, C:\Windows\SoftwareDistribution, and C:\Windows\Temp.
Run DISM monthly. One command: dism /online /cleanup-image /restorehealth. Takes two minutes, prevents tons of headache.
Stick with Windows 11 23H2 or later. Catalog handling got more resilient after 22H2. If you’re stuck on 10, at least keep it up to date.
Backup your drivers. Use dism /online /export-driver /destination:D:\Drivers after a clean install. If catroot2 goes nuclear, you can reinstall drivers fresh.

That’s the whole playbook. One of these will kill 0XC000A084. Go grab a coffee – you’ve earned it.