What does HRESULT 0x801F0023 (ERROR_FLT_REGISTRATION_BUSY) mean?

 
Previous Next
ERROR_FLT_NO_WAITER_FOR_REPLY WCM_E_INTERNALERROR

ERROR_FLT_REGISTRATION_BUSY

Registration reached a busy Filter Manager resource

ERROR_FLT_REGISTRATION_BUSY is the failure HRESULT 0x801F0023 (signed decimal -2145451997, unsigned decimal 2149515299). The severity bit is 1, the facility field is 31 (FACILITY_FILTER_MANAGER), and the facility-specific code field is 0x0023.

AllStat records the Windows SDK message as “The filesystem database resource is in use. Registration cannot complete at this time.”

This HRESULT reports a temporary resource-ownership conflict inside the Filter Manager registration path. It does not say that a callback table, altitude, service key, or instance definition is invalid. The immediate operation failed because the filesystem database resource required to complete registration was already in use.

Do not infer FltRegisterFilter from the name alone

The public Filter Manager error table defines this value, but Microsoft does not list it in the documented return table for FltRegisterFilter. The word “registration” therefore must not be treated as proof that FltRegisterFilter was the failing call. Capture the actual routine, user-mode control operation, or translated NTSTATUS before assigning ownership. It may appear during a broader Filter Manager lifecycle transition that updates internal filesystem or filter registration state.

Why this is different from invalid registration data

  • ERROR_FLT_INVALID_CONTEXT_REGISTRATION points to an invalid context registration definition.
  • ERROR_FLT_DUPLICATE_ENTRY identifies a duplicate handler definition for an operation.
  • ERROR_FLT_NOT_INITIALIZED means Filter Manager is not initialized for the requested work.
  • ERROR_FLT_FILTER_NOT_READY means the filter has registered but has not called FltStartFiltering.
  • ERROR_FLT_DELETING_OBJECT means the referenced Filter Manager object is already being torn down.
  • ERROR_FLT_REGISTRATION_BUSY instead identifies temporary exclusive use of the database resource needed to finish registration.

Likely concurrency patterns to investigate

  • two threads or service-control paths attempt related load, registration, or filesystem-state updates concurrently;
  • a minifilter unload or unregister path overlaps with a new load request for the same component;
  • automatic service recovery starts another instance while the original DriverEntry or teardown path is still active;
  • a management tool and the product service both issue Filter Manager load or configuration operations;
  • a callback re-enters configuration code that was designed to run only outside Filter Manager lifecycle callbacks;
  • test code repeatedly registers and tears down filters without waiting for the preceding transition to complete.

Evidence that identifies the conflicting owner

  • the precise failing API and the unconverted NTSTATUS value, if the HRESULT crossed a user/kernel boundary;
  • thread IDs, process IDs, service-control requests, and timestamps for every concurrent filter load, unload, register, start, and unregister operation;
  • whether FltRegisterFilter had already returned an opaque filter pointer before another step failed;
  • the driver’s state at failure: DriverEntry, post-registration initialization, FltStartFiltering, unload callback, or instance teardown;
  • Filter Manager event traces and the current loaded-filter/instance inventory;
  • locks held by the caller and any synchronous wait performed from an instance setup or teardown callback.

Diagnostic sequence

  • Serialize all product-owned filter lifecycle operations through one coordinator. Do not let the installer, service, watchdog, and test harness load the same minifilter independently.
  • Determine whether an earlier registration operation actually succeeded. If it returned a filter pointer, preserve that fact and follow the documented cleanup path rather than issuing another registration immediately.
  • Check for overlapping unload. FltUnregisterFilter tears down instances and removes contexts, so a new transition must not assume that cleanup is instantaneous.
  • Inspect callback code for reentrancy. Microsoft warns against thread synchronization or inter-process communication in InstanceSetupCallback because it can create deadlocks.
  • Remove unbounded retry loops. Repeated registration attempts can keep the resource busy and erase the timing evidence needed to find the original owner.
  • Reproduce with service recovery and external management tools disabled, then enable each lifecycle source separately.

Retry policy

A bounded retry can be safe only after the competing lifecycle operation is known to have completed and the caller has revalidated its state. Use delay and cancellation, not a tight loop. During DriverEntry, a component that cannot complete required initialization should normally unwind cleanly and fail the load rather than leave a partially initialized driver. If registration succeeded but a later initialization or start step failed, call the documented cleanup routine for the filter handle before returning failure.

Operational response

An administrator should first stop duplicate management activity and inspect which filter service is loading or unloading. Rebooting can clear the transient state but also destroys the concurrency evidence, so it should not be the first diagnostic step. Do not change altitudes, delete service keys, or disable unrelated filesystem filters: this HRESULT does not indicate an altitude collision or malformed registry configuration.

Practical scenario

A minifilter service is restarted by a watchdog at the same moment that an upgrade helper unloads the old driver. The new control path reaches a Filter Manager registration transition while teardown still owns the filesystem database resource and receives ERROR_FLT_REGISTRATION_BUSY. Correct recovery serializes upgrade and watchdog operations, waits for teardown completion, and retries once from a fresh state.

Official Microsoft references

Looking for a different code? Search another status or error code.