BSOD 99 (SECURITY1_INITIALIZATION_FAILED): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A later security initialization phase failed during Windows startup.

Could be also:
Constant	Type	OS
EADDRNOTAVAIL	errno	Linux
ENOSTR	errno	Mac
ENOPROTOOPT	errno	Solaris

Previous	Next
OBJECT1_INITIALIZATION_FAILED	SYMBOLIC_INITIALIZATION_FAILED

SECURITY1_INITIALIZATION_FAILED

Later security subsystem initialization failure for SECURITY1_INITIALIZATION_FAILED

SECURITY1_INITIALIZATION_FAILED is bug check code 0x00000063. This code indicates that a later phase of kernel security initialization could not complete. It can involve token infrastructure, access checks, auditing, logon-session bookkeeping, or security descriptor setup.

How to read it in a dump

The nested status and call stack decide which security facility failed.
Treat it as boot-time security infrastructure failure, not a failed interactive logon.
Security products loaded early can be relevant if they appear in the stack.

What to check

Check system file integrity, early security/filter drivers, and registry/security policy corruption.
Use recovery logs and boot debugging if the system cannot write a dump.
Look for paired logon-session reference bug checks on the same system.

References

Dump evidence

Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “this result”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order

Run WinDbg !analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line.
find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with security1 / initialization.
keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Looking for a different code? Search another status or error code.