| Previous | Next |
| ERROR_INVALID_EXE_SIGNATURE | ERROR_BAD_EXE_FORMAT |
ERROR_EXE_MARKED_INVALID
What ERROR_EXE_MARKED_INVALID means
ERROR_EXE_MARKED_INVALID is Win32 system error code associated with the documented message: “The operating system cannot run %1.” The significant condition is that the executable header contains state that marks the image invalid for execution. For ERROR_EXE_MARKED_INVALID, preserve the symbolic name together with the numeric value because older diagnostic tools may display only one form.
ERROR_EXE_MARKED_INVALID is normally raised before application code reaches its regular entry point. For ERROR_EXE_MARKED_INVALID, the loader is validating image metadata, segment layout, imports, or the module class, so changing runtime permissions or retrying the same launch rarely addresses the root cause.
Likely causes
- a damaged build artifact contains invalid header flags
- a legacy linker emitted a module state unsupported by Windows
- an installer copied a placeholder, patch intermediate, or partially updated image
Diagnostic procedure
- compare the complete header with the released binary
- check installer and patch logs for an interrupted replacement
- replace the image atomically and verify its signature and version before relaunching
During a ERROR_EXE_MARKED_INVALID investigation, capture the first operation returning ERROR_EXE_MARKED_INVALID. In the ERROR_EXE_MARKED_INVALID timeline, a later cleanup failure can be easier to notice while no longer describing the original defect. The evidence set for ERROR_EXE_MARKED_INVALID should record executable path, file version, architecture, Windows build, compatibility settings, and non-secret inputs used by the failing operation.
How to interpret the result in modern software
ERROR_EXE_MARKED_INVALID belongs to the 0–499 system-error range, but its wording may describe a historical subsystem. Do not classify ERROR_EXE_MARKED_INVALID automatically as a current Windows kernel defect. For ERROR_EXE_MARKED_INVALID, first determine whether the value came directly from GetLastError(), was translated from another status domain, arrived over a protocol, or was stored by an old application. Because ERROR_EXE_MARKED_INVALID can be propagated through wrappers, a missing producer API leaves translation errors and stale last-error values indistinguishable.
Code-specific investigation notes
An image can be syntactically recognizable yet carry header state that tells the loader not to execute it. This differs from an unreadable signature.
Interrupted patching is a common operational pattern: a temporary or half-written image becomes visible before the final atomic rename.
Check whether endpoint security quarantined or transformed the file, but do not disable protection merely because the timing coincides with the failure.
Developer guidance
Code handling ERROR_EXE_MARKED_INVALID should check the exact API return first, copy the last-error value immediately, and avoid intervening calls before logging. If ERROR_EXE_MARKED_INVALID is raised by a loader or compatibility helper, collect parent-process diagnostics because the child may never initialize its own logger. For ERROR_EXE_MARKED_INVALID, validate format-specific fields with an appropriate parser; byte-level edits made only to suppress ERROR_EXE_MARKED_INVALID can turn a clean rejection into corruption or unsafe execution.
Administrator and support guidance
To recover from ERROR_EXE_MARKED_INVALID, prefer a matched trusted binary/configuration set over individual DLL downloads or global compatibility changes. Before replacing an artifact associated with ERROR_EXE_MARKED_INVALID, retain it and calculate a cryptographic hash. When ERROR_EXE_MARKED_INVALID is isolated to one account or session, compare mappings, namespaces, environment, current directory, and policy before considering system-wide reinstall.
Example incident
A deployment replaces one component but leaves an older companion module. At the next launch, the loader reads the image and returns ERROR_EXE_MARKED_INVALID before normal application logging starts.
Difference from related errors
ERROR_INVALID_EXE_SIGNATURE points to signature recognition; ERROR_EXE_MARKED_INVALID means the loader parsed the image but found it marked invalid.
Evidence to collect
- the raw decimal and hexadecimal value corresponding to
ERROR_EXE_MARKED_INVALID - the exact API, command, or loader action that first produced the result
- paths after normalization and redirection, plus hashes and versions of involved binaries
- process architecture, session identity, compatibility mode, and relevant virtualization details
- a timestamp that can be correlated with application logs, Process Monitor traces, and Windows Event Log
Recovery and verification
A ERROR_EXE_MARKED_INVALID repair is verified only when the original operation succeeds with equivalent inputs and produces usable output. After correcting ERROR_EXE_MARKED_INVALID, repeat the action in a fresh process and again in the same workflow to test both stale-state removal and repeatable cleanup. If reboot alone removes ERROR_EXE_MARKED_INVALID, collect enough evidence to identify which mapping, lock, process, or compatibility state the reboot cleared.
References
Looking for a different code? Search another status or error code.