ELAM_DRIVER_DETECTED_FATAL_ERROR 0x00000178 and security subsystem crashes

Fix it now

0x00000178 is an early launch anti-malware driver reporting a fatal error. Parameter 1 says whether a TPM attestation could not be revoked or, far more often, the ELAM vendor’s own code raised a defined failure. ELAM drivers load before every other boot-start driver, so the machine stops seconds into boot and you need the recovery environment to get in.

bcdedit /enum

1. Get into the recovery environment: hold Shift while selecting Restart from the sign-in screen, boot from installation media and choose Repair your computer, or let Windows enter it automatically after two consecutive failed start attempts.
2. Go to Troubleshoot, then Advanced options, then Startup Settings, and restart. On the menu that appears, choose the option that disables early launch anti-malware protection. It applies to that boot only.
3. Once Windows starts, uninstall the endpoint security agent using the vendor’s dedicated removal tool, which clears the ELAM registration as well as the product.
4. Reboot normally and confirm the machine reaches the sign-in screen without the workaround.
5. Install a current supported build of the agent and reboot once more to prove its ELAM driver loads cleanly.

If several machines updated at once and several are now down, hold the agent update in your management console before you start fixing them one at a time.

If the machine boots after the agent is replaced, you are done. If it does not, or if the stop code is 0x0000011D instead, the next section covers what else runs in that window.

Why it happens

ELAM drivers are boot-start drivers that declare themselves with a start type of boot-start and a load order group of Early-Launch. They load during kernel initialisation, ahead of the other boot-start drivers, and classify each of those images through a callback as known good, known bad or unknown. The kernel then applies a load policy to those classifications and decides what may initialise. The whole arrangement exists so that malware cannot win the race by loading earlier than the security product.

The price of loading first is that there is nothing underneath you. An ELAM driver runs with no user session, no full registry and no networking, and Microsoft holds it to hard limits: half a millisecond to evaluate each driver, fifty milliseconds for all of them, and 128 kB for the driver plus its configuration data. It is meant to be small, self-contained and signed for this specific role. When it faults the kernel cannot skip it, because the point of the mechanism is that boot does not proceed unvetted.

Parameter 1 is the part worth reading. A value of 0x0 means a TPM attestation could not be revoked, and parameters 2 and 3 carry the image information structure and the TPM result code. A value of 0x10000 means an ELAM-vendor defined failure, with two optional vendor-supplied values behind it. In practice the second is what you meet, and it means the agent’s own code decided it could not continue. That is a vendor defect, not a Windows one, and no amount of policy tuning will change it.

0x0000011D belongs in the same few seconds for a different reason. Modern endpoint agents rely on kernel trace sessions started at boot, and this code says the event tracing subsystem hit an unexpected fatal error, with parameter 1 naming the subtype: kernel mode registration corruption, an invalid handle on unregistration, trace buffer corruption, lost events and so on. An agent with a broken autologger configuration can take the tracing subsystem down with it, and the stop looks like a security product failure because it is one.

Full reference

The documented driver load policy values

The policy is read from HKLM\SYSTEM\CurrentControlSet\Control\EarlyLaunch\DriverLoadPolicy. A related value in the same key, BackupPath, is where the location of a backup ELAM driver is read from. Export the key before you change anything: a wrong value here can leave the machine unable to boot, and you will be recovering it from installation media.

Why the boot override cannot be made permanent

There is a boot configuration datatype for this, disableelamdrivers, and it is documented. What is also documented is that it does not survive: the operating system loader removes the entry for security reasons, the option can only be triggered from the boot menu, and someone has to be physically present at the machine to trigger it. Microsoft’s own note says it should only be used for debugging.

So if a repair needs several reboots, plan for the person doing the repair to select the option at each boot, or do the work from the recovery environment or Safe Mode instead. Writing the value into the boot store and walking away will not do what you want, and a machine running permanently without its early launch driver has lost a real defence in any case.

bcdedit /enum

Telling the variants apart

Reaching the recovery environment

• From the sign-in screen, select Shutdown and then hold Shift while selecting Restart.
• From recovery media, choose Repair your computer at the Install Windows screen.
• Automatically, after two consecutive failed attempts to start Windows, two consecutive unexpected shutdowns within two minutes of boot completing, or two consecutive reboots within two minutes of boot completing.
• From a hardware recovery button or button combination where the manufacturer has configured one.

If Safe Mode is quicker

Safe Mode loads a minimal driver set, so an agent that fails a normal boot often does not start at all there. If Safe Mode reaches a desktop, do the uninstall from it. It is usually faster than the Startup Settings route and it leaves nothing to clean up in the boot store afterwards.

Removing an endpoint agent from the recovery environment or Safe Mode leaves the machine unprotected until you finish. Do the work on a network you control, and confirm the replacement is running before the machine goes back to a user.

Every code this article covers

Confirm the fix worked

1. Reboot normally, without the Startup Settings workaround, and confirm the machine reaches the sign-in screen.
2. Run bcdedit /enum and confirm no early launch override has been left set.
3. Check the System log for boot-time errors from the security product.
4. Confirm DriverLoadPolicy is at the value you intended, and that you have a record of any change.
5. Confirm the endpoint agent reports itself running and up to date in its own console.

Questions people ask about this