Windows Stop Code SECURITY_SYSTEM (0x00000029): Meaning and Troubleshooting
Quick Answer SECURITY_SYSTEM is Windows bug check 0x00000029. Microsoft says it appears very infrequently and recommends WinDbg’s !analyze extension to help ...
Quick Answer
SECURITY_SYSTEM is Windows bug check 0x00000029. Microsoft says it appears very infrequently and recommends WinDbg’s !analyze extension to help determine the root cause. Its dedicated reference does not describe a precise triggering condition, define the four bug-check parameters, or provide a universal fix. Microsoft Learn
The word “SECURITY” in the name does not establish that malware is present, an account has been compromised, or an attacker caused the crash. Confirm the stop code in the original crash dump and investigate the stack and system history before drawing a conclusion.
What Does the Name Tell You?
SECURITY_SYSTEM is the symbolic label assigned to bug check 0x29. Microsoft’s dedicated page supplies the value, notes that the code is very infrequent, and points to !analyze for investigation. It does not identify the particular Windows security component or state involved. Microsoft Learn
That limits what can honestly be diagnosed from a table row. For example, the name alone cannot tell you whether the failure involved an access token, a driver’s memory operation, a security product, or another path. Those questions require the dump from an actual crash.
Stop Code at a Glance
| Item | Documented information |
|---|---|
| Bug-check value | 0x00000029 |
| Symbolic name | SECURITY_SYSTEM |
| Frequency | Appears very infrequently. |
| Published parameter definitions | None on the dedicated 0x29 page. |
| Published code-specific cause | None on the dedicated 0x29 page. |
| Recommended debugger starting point | !analyze |
What 0x29 Does Not Prove
A SECURITY_SYSTEM label is not evidence by itself of:
- Malware or ransomware.
- A stolen password or Windows account.
- A failed antivirus product.
- A particular Windows security feature being disabled.
- A specific faulty driver or hardware component.
These possibilities should be assessed only if independent evidence supports them. The official 0x29 reference does not assign any of them as the cause. Microsoft Learn
How to Investigate an Actual 0x29 Crash
1. Verify the complete hexadecimal code
Confirm 0x00000029 in the original blue-screen record or crash dump. Do not confuse it with a numerical value that appears as an argument of a different bug check. For example, the arguments of other stop codes can include 0x29 without the stop code itself being SECURITY_SYSTEM.
2. Preserve the crash dump
Keep the dump created when Windows stopped. A screenshot or a one-line crash report may omit the call stack, executing thread, and loaded modules needed for a meaningful investigation.
3. Run the initial WinDbg analysis
Open the dump in WinDbg and run:
!analyze -vRecord the bug-check value, the four arguments exactly as displayed, the stack trace, and any module named by the analysis. Microsoft specifically recommends !analyze for 0x29. The suggested module should be checked against the full execution path before assigning fault. Microsoft Learn
4. Examine the stack
Use a detailed stack display such as:
kvAsk what the failing thread was doing and which driver modules were involved. If the stack shows a security-related operation, trace that operation in context. If it does not, do not force an explanation based only on the symbolic name.
5. Compare other dumps and recent changes
If the crashes repeat, compare their stacks and implicated modules. Note driver, device, Windows, and security-software changes made before the first failure. Check Event Viewer → Windows Logs → System for nearby errors and correlate them with the dumps.
A recently installed product is a lead, not proof that it caused the bug check.
6. Choose a supported remedy
If repeated analysis implicates a particular third-party driver, check its vendor for an update or supported rollback. If the evidence indicates a separate security incident, investigate that incident on its own merits. If the dump does not reveal the cause, provide it and the reproduction steps to a Windows debugging specialist.
Guidance for Driver Developers
When the relevant stack leads into a driver you maintain, review the actual operation, object lifetimes, error paths, and interactions with adjacent kernel components. Determine whether the driver caused an invalid state or merely encountered one that had already been created.
Do not assign fixed meanings to Arg1–Arg4 for 0x29: Microsoft’s dedicated reference does not publish a parameter table. Record the values and interpret them only when supported by the dump, symbols, and the Windows build under investigation. Microsoft Learn
Guidance for End Users
If you saw SECURITY_SYSTEM on a blue screen:
- Record the complete code and the time of the failure.
- Keep the crash dump, especially if it happens again.
- Note recent driver and software changes.
- Base updates or rollbacks on dump evidence or guidance from the relevant vendor.
There is no Microsoft-documented 0x29-specific reason to reset all passwords, delete user profiles, disable security protection, or reinstall Windows. Take any security response based on separate signs of compromise, not the stop-code name alone. Microsoft Learn
Frequently Asked Questions
What is SECURITY_SYSTEM?
It is the symbolic name for Windows bug check 0x00000029. Microsoft says the bug check appears very infrequently. Microsoft Learn
Does this stop code mean I have malware?
No such conclusion follows from the code. Microsoft’s 0x29 page does not identify malware as its cause. Microsoft Learn
Does it mean my Windows account was hacked?
The stop code does not establish an account breach. Investigate account activity separately if you have evidence of unauthorized access.
What do the four parameters mean?
Microsoft does not define them on its dedicated 0x29 page. Do not borrow parameter meanings from a different security-related bug check. Microsoft Learn
Is this the same as CORRUPT_ACCESS_TOKEN?
No. CORRUPT_ACCESS_TOKEN is 0x00000028; SECURITY_SYSTEM is 0x00000029. They are separate bug-check entries. learn.microsoft.com
Which WinDbg command should I start with?
Run !analyze -v, then inspect the stack and the evidence in the dump. Microsoft specifically recommends !analyze for this code. Microsoft Learn
Summary
SECURITY_SYSTEM (0x00000029) is a very rare Windows bug check with limited public documentation. Its security-related name does not identify a breach, product, or driver. For an actual crash, verify the code, preserve the dump, run !analyze -v, and let the stack and related system evidence guide the next action. Microsoft Learn
Sources
Was this guide useful?
Your answer helps us keep BISONKB accurate and practical.