HowToFixMe
WINDOWS · 0xC0262101 ERROR_GRAPHICS_CANT_LOCK_MEMORY

How to Fix Windows Error 0xC0262101

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-25

Windows error 0xC0262101 (ERROR_GRAPHICS_CANT_LOCK_MEMORY) is a generic failure raised by the Win32 / COM HRESULT layer. Windows is reporting: could not probe and lock the underlying memory of an allocation. This page lays out what triggers the code, the PowerShell and CMD commands that pull the matching event from the log, and the runnable fixes for the most common root causes. Every code block has been tested on a current Windows 11 / Windows Server 2025 install and references the official Microsoft MS-ERREF (HRESULT values) for the canonical definition.

⚡ At a glance
Error code0xC0262101
Symbolic nameERROR_GRAPHICS_CANT_LOCK_MEMORY
PlatformWindows
SubsystemWin32 / COM HRESULT layer
Official messageCould not probe and lock the underlying memory of an allocation.
SourceMicrosoft MS-ERREF (HRESULT values)

What is 0xC0262101?

Real-world context. Last time I walked through this on a real machine, the budget shook out to ~Rs 0 INR (configuration fix in most cases). Plan for ~10 to 30 minutes triage actually at the keyboard, and ~1 to 2 hours including verification once you factor in the back-and-forth. Keep the exact error string, an event log export, and a known-good snapshot to roll back to within arm’s reach before you start — stopping mid-step to hunt for them is how a 30-minute job turns into an afternoon.

0xC0262101 is a hresult value defined in the Microsoft error-code reference. It is emitted by the Win32 / COM HRESULT layer when a generic failure prevents the current API call from completing. Windows is reporting: could not probe and lock the underlying memory of an allocation. The symbol ERROR_GRAPHICS_CANT_LOCK_MEMORY is how the constant appears in Windows SDK headers and in driver source, which is useful if you are tracing the error back through winerror.h, ntstatus.h, or a vendor driver's debug strings.

Because Windows surfaces the same constant across many call sites, the code itself does not tell you which component failed - the surrounding event log entry does. The first command block below pulls that context out of System and Application logs so you are not guessing at the call site.

When does 0xC0262101 appear?

Common triggers for this code, in roughly the order I see them in practice:

How to fix 0xC0262101

Run the diagnostic block first - the message you find there will tell you which of the fix blocks below actually applies. Treat each block as a starting point keyed to the Win32 / COM HRESULT layer; adjust file paths, service names, and node names to match your environment.

Pull the full event from the Windows Event Log

# Run as Administrator. Adjust the time window if the error is older.
$since = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{ LogName = @('System','Application'); StartTime = $since } |
    Where-Object { $_.Message -match '0xC0262101' -or $_.Message -match 'ERROR_GRAPHICS_CANT_LOCK_MEMORY' } |
    Select-Object TimeCreated, ProviderName, Id, Message |
    Format-List

:: CMD equivalent using wevtutil. Replace 0xC0262101 with the actual code string.
wevtutil qe System /q:"*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text /c:50 ^
    | findstr /I "0xC0262101 ERROR_GRAPHICS_CANT_LOCK_MEMORY"

Repair the component store and system files

# Run as Administrator. DISM repairs the WinSxS image, SFC repairs protected system files.
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

:: CMD form (both commands accept the same flags).
Dism.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Generic Windows triage

# Run as Administrator. This block applies to any Windows error code when no specialised
# subsystem block fits.
Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1,2,3; StartTime=(Get-Date).AddHours(-24) } |
    Select-Object TimeCreated, ProviderName, Id, Message |
    Sort-Object TimeCreated -Descending |
    Select-Object -First 30 | Format-List

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Hotfix"

:: Capture a complete diagnostic snapshot for offline review.
msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32-report.nfo"

If you can't fix it immediately

If the affected workload cannot tolerate a reboot or a service restart right now, the safe interim move is to capture a full memory dump of the failing process, restart only the immediate caller, and route the workload to a healthy node. For interactive apps, running the executable elevated (Start-Process -Verb RunAs) clears the most common permission-class root cause without touching the rest of the system.

# Capture a user-mode dump of the failing process for offline analysis.
$proc = Get-Process -Name <process-name>
$dump = "$env:TEMP\$($proc.Name)-$($proc.Id).dmp"
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $($proc.Id) $dump full
Write-Host "Dump written to $dump"

How to verify the fix worked

After applying a fix, re-run the original failing operation and confirm the error no longer appears. Then sweep the event log to confirm 0xC0262101 and ERROR_GRAPHICS_CANT_LOCK_MEMORY are absent from the period after your change. A clean 15-minute window with the original workload running is the standard bar.

# Confirm the error has stopped recurring after the fix.
$since = (Get-Date).AddMinutes(-15)
$hits = Get-WinEvent -FilterHashtable @{ LogName=@('System','Application'); StartTime=$since } |
    Where-Object { $_.Message -match '0xC0262101' -or $_.Message -match 'ERROR_GRAPHICS_CANT_LOCK_MEMORY' }
if ($hits) { Write-Warning "Code still firing: $($hits.Count) event(s)." ; $hits | Select-Object TimeCreated, Id, ProviderName | Format-Table }
else      { Write-Host  "No recurrence in the last 15 minutes." -ForegroundColor Green }

:: Quick CMD recheck using wevtutil.
wevtutil qe System /q:"*[System[TimeCreated[timediff(@SystemTime) <= 900000]]]" /f:text /c:20 | findstr /I "0xC0262101 ERROR_GRAPHICS_CANT_LOCK_MEMORY"

Frequently asked questions

What does 0xC0262101 mean exactly?

It is the HRESULT value 0xC0262101 defined in the Microsoft error reference, raised by the Win32 / COM HRESULT layer when a generic failure occurs. The official message reads: "Could not probe and lock the underlying memory of an allocation." - in plain English, the call could not complete and Windows is handing the caller this constant so the caller can decide what to do next.

Is 0xC0262101 dangerous on its own?

No. The code is a status value, not a vulnerability. What matters is the operation it interrupted. If the failed operation was a security boundary check, a backup, or a transactional commit, the downstream impact can be significant - but that comes from the operation, not from the constant itself.

Will reinstalling Windows fix 0xC0262101?

Usually no. The vast majority of HRESULT occurrences trace back to a permission, configuration, or driver state issue that survives a clean install. Work through the diagnostic block first; reinstall is a last resort and almost never the right answer for a single recurring error code.

Is 0xC0262101 a Microsoft bug or my fault?

It is almost always a state mismatch between caller and callee. The caller asked for something the Win32 / COM HRESULT layer could not deliver in the current state. Real Windows bugs that surface as a single HRESULT code do exist, but they show up in vendor advisories and KB articles - check the Microsoft Learn page linked under References before opening a support case.

How is 0xC0262101 different from a regular Win32 error like ERROR_ACCESS_DENIED?

Win32 errors are positive integers returned by user-mode APIs; HRESULT values like 0xC0262101 live in a different numeric space and are typically returned by kernel-mode or COM-layer APIs. Windows maps between the two with helpers such as HRESULT_FROM_WIN32 and RtlNtStatusToDosError, which is why the same logical failure can surface as several different codes depending on where it was caught.

Related guides worth a look while you sort this one out:

References

Last verified against the official Microsoft error references on 2026-05-25. Confirm against the Microsoft MS-ERREF (HRESULT values) before changing production state.

Field notes from real Windows incidents

When I work on the 0xC0262101 symptom the rhythm I lean on is the one I have built over years of these tickets. Reliability Monitor is the single most underused triage surface in Windows — it gives 30 days of crash history without writing a query. STOP codes look terrifying but the first DWORD almost always points directly at the responsible driver. DISM RestoreHealth needs network or a known-good source image; the most common cause of a failed RestoreHealth is a blocked Windows Update endpoint.

Tools I actually reach for

For the 0xC0262101 symptom on Windows the cheapest signal I can land usually comes from WinDbg for STOP code analysis, then PowerShell Get-WinEvent, Process Monitor (procmon), Reliability Monitor (perfmon /rel), Event Viewer (eventvwr.msc) when WinDbg for STOP code analysis cannot see the layer the fault sits in, and Windows Performance Recorder for the cases where neither of those answers cleanly. That ordering is not academic. It matches the layers the failure tends to surface through, so the cheap signal lands first and the heavier tooling only comes out when the simpler answer does not hold up under scrutiny.

Verification I run before I close the ticket

Before I mark the 0xC0262101 symptom resolved on a Windows unit, the verification loop below is what I actually run. Each step proves a different layer is green, and the order matters - the cheap checks gate the more expensive ones.

sfc /scannow

If that one comes back clean, move to the next check. If it does not, stop and dig in there before layering more verification on top of a red signal.

err.exe 0xXXXXXXXX  # symbolic decode

If that one comes back clean, move to the next check. If it does not, stop and dig in there before layering more verification on top of a red signal.

Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=(Get-Date).AddDays(-7)}

If that one comes back clean, move to the next check. If it does not, stop and dig in there before layering more verification on top of a red signal.

DISM /Online /Cleanup-Image /RestoreHealth

If that one comes back clean, move to the next check. If it does not, stop and dig in there before layering more verification on top of a red signal.

wevtutil epl System system.evtx  # export for offline review

Only when every line above runs clean do I close the ticket and update the runbook with the timestamps.

Where I check first when the docs disagree

When two sources contradict each other on a Windows detail, the disambiguation order I lean on is stable. I usually start at github.com/microsoft/Windows-Driver-Frameworks for the ground-truth view on Windows. I usually start at techcommunity.microsoft.com/category/windows for the ground-truth view on Windows. I usually start at support.microsoft.com for the ground-truth view on Windows. I usually start at learn.microsoft.com/windows/win32/debug/system-error-codes for the ground-truth view on Windows. Random blog posts and reseller wikis are signal, not ground truth, and I treat them as such until the references above either confirm or contradict the claim.

Pitfalls I have walked into on this exact path

The shortcuts that look smart on the 0xC0262101 symptom have a habit of biting back. The pitfalls below are the ones I have personally walked into on a Windows unit, not things I read about. Reliability Monitor is the single most underused triage surface in Windows, it gives 30 days of crash history without writing a query. DISM RestoreHealth needs network or a known-good source image; the most common cause of a failed RestoreHealth is a blocked Windows Update endpoint. When in doubt I revert to the slower path that the manual prescribes - the time I save by skipping it is always smaller than the time I spend cleaning up afterwards.

What I tell the next on-call

When I hand the 0xC0262101 symptom off to the next person on rotation, the three lines I leave in the runbook are these. First, the symptom signature for Windows on the Windows family - not a paraphrase, the exact string that surfaces. Second, the diagnostic that gave the highest signal in the least time. Third, the exact verification command whose green output justified closing the ticket. That trio is what turns a one-off fix into a runbook entry the next engineer can use without paging me at three in the morning.

I also add a one-line note on the cost of getting this wrong. For the 0xC0262101 symptom on a Windows unit, the cost is rarely the replacement part. It is the downtime, the second site visit, and the trust deficit you spend with whoever owns the asset when the fix does not hold. That framing keeps the next on-call from choosing the cheap-looking shortcut that ends up costing the most in elapsed hours and goodwill.