| Previous | Next |
| ERROR_PROFILING_NOT_STARTED | ERROR_COULD_NOT_INTERPRET |
ERROR_PROFILING_NOT_STOPPED
What ERROR_PROFILING_NOT_STOPPED means
The code indicates that a profiling facility still considers the session active after a stop request. Unlike a harmless duplicate stop, this condition can leave counters, callbacks, or kernel resources attached until the owner exits or performs a successful cleanup.
Where it commonly appears
- Sampling profilers and performance counters
- Long-running diagnostic services
- Automated test harnesses that start and stop profiling around each case
Likely causes
- The target is still executing in a state that prevents immediate teardown
- The stop request used stale or mismatched session parameters
- A driver or provider did not acknowledge shutdown
- Another thread changed the profiling state concurrently
Diagnostic checklist
- Capture the start parameters and exact stop parameters side by side
- Check whether the target process exited or changed identity during the session
- Inspect provider, driver, and service logs for teardown timeouts
- Determine whether the session remains visible to the profiling tool after the failure
Guidance for developers
Treat failure to stop as a cleanup failure that deserves telemetry, but preserve the primary operation result. Avoid immediately starting another session with the same identifiers. Apply a bounded retry only when the API documentation permits it and the state can be rechecked.
Guidance for administrators
Close the owning profiler cleanly before restarting dependent services. If a kernel component remains attached, a service restart or system restart may be required, but collect logs first because the restart destroys useful evidence.
Example incident
A test runner ends a benchmark while the profiler provider is still flushing data. The first stop request returns this status. Waiting for the provider-completion event and issuing one documented retry succeeds; issuing repeated blind stop calls only obscures the timing problem.
Related conditions
This differs from ERROR_PROFILING_NOT_STARTED, where no active session exists, and from a generic timeout, which does not necessarily describe profiling state.
Operational decision points
This code becomes actionable only after it is tied to a profiler teardown condition and not merely a transient API failure. For ERROR_PROFILING_NOT_STOPPED, the deciding evidence is provider completion, pending samples, target lifetime, stop acknowledgement. Preserving this first-occurrence evidence is more useful than increasing retry frequency for investigation sequence 14.
- Impact boundary: identify the exact process, account, device, file, session, host, or connection affected by this result; do not assume the whole machine is in the same state.
- State change required: the next attempt is justified only after the relevant profiler teardown state can differ from the failed attempt.
- Partial outcome: verify whether the operation allocated resources, changed data, sent a request, or modified policy before this result was returned.
- Escalation evidence: preserve provider completion, pending samples, target lifetime, stop acknowledgement together with component version and the first preceding failure.
Concrete recovery example
Consider a case where a benchmark ended while the provider was still flushing samples. Repeating the same call leaves the underlying condition unchanged and produces another this result. The durable response is to wait for documented completion before creating a replacement profile. Validation for this Win32 error should use one controlled operation and inspect both the returned status and the resulting state associated with case 14.
Monitoring and validation
A monitoring rule for this Win32 error should distinguish first occurrence from repetition, group events by affected object, and correlate them with deployments or configuration changes. The recovery is complete only when the expected profiler teardown state is present and consistent; absence of another log line by itself is not sufficient proof.
Retain the original this result event until validation for investigation case 14 is complete. After it is corrected, verify that no partial or stale artifact specific to remediation sequence 14 remains before declaring recovery complete. This it-specific verification prevents a hidden secondary problem from surviving after remediation step 14.
References
Looking for a different code? Search another status or error code.