| Previous | Next |
| PROCESS1_INITIALIZATION_FAILED | SESSION1_INITIALIZATION_FAILED |
REFMON_INITIALIZATION_FAILED
Reference monitor initialization failure for REFMON_INITIALIZATION_FAILED
REFMON_INITIALIZATION_FAILED is bug check code 0x0000006C. The reference monitor enforces access checks and security decisions in the kernel. This bug check indicates that this security enforcement component could not initialize consistently during boot.
How to read it in a dump
- The failure is boot-time security infrastructure, not a single denied access check.
- Nested status codes, security descriptors, token setup, and early security callbacks are relevant.
- Security products or system file corruption can be involved if visible in the dump.
What to check
- Check early-loaded security products and kernel callbacks.
- Verify system files and security policy registry state.
- Compare with SECURITY_INITIALIZATION_FAILED and SECURITY1_INITIALIZATION_FAILED.
References
- Security checks in drivers
- Kernel-mode support routines
- Microsoft Bug Check Code Reference
- Crash dump files and WinDbg
Dump evidence
Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “this result”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order
- Run WinDbg
!analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line. - find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with refmon / initialization.
- keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.