What does Windows error code 591 (ERROR_SYSTEM_PROCESS_TERMINATED) mean?

ERROR_SYSTEM_PROCESS_TERMINATED

What this result means

ERROR_SYSTEM_PROCESS_TERMINATED is a Windows system result. This is a fatal operating-system condition. Windows cannot continue safely when a required process such as a core session or security component exits, so the system normally bugchecks or initiates recovery. The parameters and preceding events are essential to identify the originating component.

Likely causes

• a critical process crashed because of a software defect or corrupted module
• storage or memory corruption damaged executable or runtime data
• malware, security software, or a driver interfered with a protected process
• an update, rollback, or servicing operation left incompatible system files

Where this code is usually encountered

• A protected user-mode process such as a session, logon, or service-control component exits unexpectedly.
• A kernel or driver fault corrupts a critical process and the visible termination is only the final symptom.
• Servicing leaves core binaries or dependencies inconsistent across a reboot.

Useful evidence

• the bugcheck code and all parameters
• the named critical process, exception code, and termination status
• kernel and user dumps, WER data, and loaded-module versions
• servicing, storage, WHEA, and security events preceding the crash

Troubleshooting steps

1. Preserve the first complete dump before running repair tools that may change binaries and timestamps.
2. Use the process name and termination status to choose the next analysis path; access violation, stack corruption, and missing image each imply different evidence.
3. Compare third-party drivers, injected modules, and security products with a known-good machine.
4. Validate component-store, disk, and memory health only after collecting evidence, then retest under a controlled software set.

Guidance for developers

Services must not mark themselves critical merely to obtain restart behavior. Components running inside or injecting into critical processes need strict version checks, fail-closed initialization, and crash telemetry that identifies the first faulting module.

Guidance for administrators

Repeated crashes require dump analysis, not a loop of SFC, DISM, and reboot without evidence. Use supported recovery media or rollback when servicing inconsistency is confirmed.

How to interpret it correctly

The terminated process may not be the root cause. A driver that damaged its memory can fail earlier, while Windows reports the critical process only when it finally exits.

Example failure pattern

An incident may show a critical process terminating with access violation while the actual corruption originated earlier in a kernel driver, injected module, storage read, or failed update. Build a timeline from the first hardware, servicing, driver, or exception event through the final process exit instead of treating the last stack as complete causality.

Retry and recovery policy

The system itself usually restarts or bugchecks, so application retry policy is irrelevant. Operational policy should preserve dumps across reboot, avoid automatic cleanup that deletes them, and escalate after the first recurrence with the same signature.

References

• Microsoft: System error codes 500–999
• Microsoft: System error codes