What does HRESULT 0x87C51040 (UTC_E_FAILED_TO_START_NDISCAP) mean?

UTC_E_FAILED_TO_START_NDISCAP

Where the UTC workflow stopped: NDIS capture component startup

UTC_E_FAILED_TO_START_NDISCAP has the unsigned value 0x87C51040. In UTC it comes from network or kernel diagnostic capture, where NDIS capture component startup owns the decision. The decisive question is which UTC object rejected the request for this HRESULT. The immediate contract failed because network capture passed policy but the NDISCAP service/driver path did not become operational, so diagnosis should remain at that boundary until a controlled comparison crosses it for this HRESULT.

Network and kernel captures are high-impact diagnostic actions for this HRESULT. Policy approval, capture-component startup, ETW/driver resources and rate limits are independent gates and should be verified in that order for this HRESULT. Record the configuration package or scenario generation together with the Windows build; otherwise a repaired file can be tested against a stale in-memory graph and appear to fail for the same reason for this HRESULT.

Evidence to preserve

The AllStat message names the immediate condition as “Failed to start NDISCAP service for network packet capture trace” for this HRESULT. In practice, the useful extension is to ask whether the request was rejected before any side effect, after partial setup, or during cleanup for this HRESULT. Verify the existence and ownership of the expected output—session, directory, process, result object or emitted event—rather than assuming the message describes the final system state for this HRESULT.

Controlled reproduction

1. Export the relevant Microsoft-Windows-UniversalTelemetryClient/Operational events and preserve their ActivityId or request correlation alongside this result.
2. Capture service/driver state, filter bindings, target adapters, start HRESULT, privileges and operational logs for this HRESULT. Do this before restarting the service or deleting any working directory for this HRESULT.
3. Perform this one-variable comparison: start a capture on one known physical adapter and compare with the failing adapter/topology for this HRESULT.
4. After the comparison, record the next HRESULT and whether the requested session, action, trigger or output object was actually created for this HRESULT.

The most informative neighbor is UTC_E_NETWORK_CAPTURE_NOT_ALLOWED. The distinction is concrete: UTC_E_NETWORK_CAPTURE_NOT_ALLOWED is a policy denial before component startup for this HRESULT. Keeping both symbolic names in logs prevents a broad “DiagTrack error” bucket from hiding whether the failure occurred during parsing, authorization, resource acquisition, execution or teardown for this HRESULT.

Capture safety

When testing this result, keep scope and duration minimal, document where the capture is stored and verify normal stop/cleanup for this HRESULT. Packet and kernel captures can contain sensitive data and consume bounded system resources for this HRESULT.

Correction and verification

Repair the capture component or binding and verify clean start/stop; avoid reinstalling unrelated network protocols for this HRESULT. Apply that change only to the owning boundary for this HRESULT. A successful repair must make the controlled case cross this boundary while retaining the intended policy, trace providers, destination and security context for this HRESULT.

Deleting the working directory, killing all ETW sessions or retrying in a tight loop can suppress this result temporarily while leaving the underlying lifecycle defect intact for this HRESULT.

• the same request now produces its documented success or nonfatal status without a second hidden retry
• the operational log shows one coherent request lifetime and no orphaned action, timer, process or trace session
• teardown followed by a second run does not reuse stale state or recreate NDIS capture component startup
• the nearby condition remains distinguishable: UTC_E_NETWORK_CAPTURE_NOT_ALLOWED is a policy denial before component startup

Technical references

• Microsoft Open Specifications: Windows error-code registry — reference for network or kernel diagnostic capture while interpreting this result.
• Microsoft: Universal Telemetry Client configuration diagnosis — reference for network or kernel diagnostic capture while interpreting it.
• Microsoft: NDIS filter-driver installation and binding
• Microsoft: Packet Monitor overview

Looking for a different code? Search another status or error code.