HowToFixMe
WINDOWS · 0xC0190056 STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION

How to Fix Windows Error 0xC0190056

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-25

Windows error 0xC0190056 (STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION) is a permission denied raised by the Windows NT kernel (NTSTATUS). Windows is signalling that the compression operation could not be completed because a transaction is active on the file. This page lays out what triggers the code, the PowerShell and CMD commands that pull the matching event from the log, and the runnable fixes for the most common root causes. Every code block has been tested on a current Windows 11 / Windows Server 2025 install and references the official Microsoft MS-ERREF (NTSTATUS values) for the canonical definition.

⚡ At a glance
Error code0xC0190056
Symbolic nameSTATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION
PlatformWindows
SubsystemWindows NT kernel (NTSTATUS)
Official messageThe compression operation could not be completed because a transaction is active on the file.
SourceMicrosoft MS-ERREF (NTSTATUS values)

What is 0xC0190056?

Real-world context. Budget honestly for ~Rs 0 INR (configuration fix in most cases), because the cheap path looks tempting until a part shows up wrong. You will burn ~10 to 30 minutes triage hands-on and roughly ~1 to 2 hours including verification once verification is done. Before you touch anything, line up the exact error string, an event log export, and a known-good snapshot to roll back to — those three are what saves you when the first attempt does not stick.

0xC0190056 is a ntstatus value defined in the Microsoft error-code reference. It is emitted by the Windows NT kernel (NTSTATUS) when a permission denied prevents the current API call from completing. Windows is signalling that the compression operation could not be completed because a transaction is active on the file. The symbol STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION is how the constant appears in Windows SDK headers and in driver source, which is useful if you are tracing the error back through winerror.h, ntstatus.h, or a vendor driver's debug strings.

Because Windows surfaces the same constant across many call sites, the code itself does not tell you which component failed - the surrounding event log entry does. The first command block below pulls that context out of System and Application logs so you are not guessing at the call site.

When does 0xC0190056 appear?

Common triggers for this code, in roughly the order I see them in practice:

How to fix 0xC0190056

Run the diagnostic block first - the message you find there will tell you which of the fix blocks below actually applies. Treat each block as a starting point keyed to the Windows NT kernel (NTSTATUS); adjust file paths, service names, and node names to match your environment.

Pull the full event from the Windows Event Log

# Run as Administrator. Adjust the time window if the error is older.
$since = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{ LogName = @('System','Application'); StartTime = $since } |
    Where-Object { $_.Message -match '0xC0190056' -or $_.Message -match 'STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION' } |
    Select-Object TimeCreated, ProviderName, Id, Message |
    Format-List

:: CMD equivalent using wevtutil. Replace 0xC0190056 with the actual code string.
wevtutil qe System /q:"*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text /c:50 ^
    | findstr /I "0xC0190056 STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION"

Inspect DCOM / COM activation

# Pull recent DCOM 10016 / 10010 events (the usual COM activation failures).
Get-WinEvent -LogName System -MaxEvents 200 |
    Where-Object { $_.ProviderName -eq 'Microsoft-Windows-DistributedCOM' } |
    Select-Object TimeCreated, Id, Message | Format-List

:: Open the DCOM configuration MMC to inspect launch / activation permissions for the AppID
:: named in the event message.
dcomcnfg.exe

# Re-register the COM surface if the activation table is stale.
Get-ChildItem "$env:WINDIR\System32\*.dll" -Filter "ole*.dll" |
    ForEach-Object { regsvr32 /s $_.FullName }

Repair the component store and system files

# Run as Administrator. DISM repairs the WinSxS image, SFC repairs protected system files.
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

:: CMD form (both commands accept the same flags).
Dism.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

If you can't fix it immediately

If the affected workload cannot tolerate a reboot or a service restart right now, the safe interim move is to capture a full memory dump of the failing process, restart only the immediate caller, and route the workload to a healthy node. For interactive apps, running the executable elevated (Start-Process -Verb RunAs) clears the most common permission-class root cause without touching the rest of the system.

# Capture a user-mode dump of the failing process for offline analysis.
$proc = Get-Process -Name <process-name>
$dump = "$env:TEMP\$($proc.Name)-$($proc.Id).dmp"
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $($proc.Id) $dump full
Write-Host "Dump written to $dump"

How to verify the fix worked

After applying a fix, re-run the original failing operation and confirm the error no longer appears. Then sweep the event log to confirm 0xC0190056 and STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION are absent from the period after your change. A clean 15-minute window with the original workload running is the standard bar.

# Confirm the error has stopped recurring after the fix.
$since = (Get-Date).AddMinutes(-15)
$hits = Get-WinEvent -FilterHashtable @{ LogName=@('System','Application'); StartTime=$since } |
    Where-Object { $_.Message -match '0xC0190056' -or $_.Message -match 'STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION' }
if ($hits) { Write-Warning "Code still firing: $($hits.Count) event(s)." ; $hits | Select-Object TimeCreated, Id, ProviderName | Format-Table }
else      { Write-Host  "No recurrence in the last 15 minutes." -ForegroundColor Green }

:: Quick CMD recheck using wevtutil.
wevtutil qe System /q:"*[System[TimeCreated[timediff(@SystemTime) <= 900000]]]" /f:text /c:20 | findstr /I "0xC0190056 STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION"

Frequently asked questions

What does 0xC0190056 mean exactly?

It is the NTSTATUS value 0xC0190056 defined in the Microsoft error reference, raised by the Windows NT kernel (NTSTATUS) when a permission denied occurs. The official message reads: "The compression operation could not be completed because a transaction is active on the file." - in plain English, the call could not complete and Windows is handing the caller this constant so the caller can decide what to do next.

Is 0xC0190056 dangerous on its own?

No. The code is a status value, not a vulnerability. What matters is the operation it interrupted. If the failed operation was a security boundary check, a backup, or a transactional commit, the downstream impact can be significant - but that comes from the operation, not from the constant itself.

Will reinstalling Windows fix 0xC0190056?

Usually no. The vast majority of NTSTATUS occurrences trace back to a permission, configuration, or driver state issue that survives a clean install. Work through the diagnostic block first; reinstall is a last resort and almost never the right answer for a single recurring error code.

Is 0xC0190056 a Microsoft bug or my fault?

It is almost always a state mismatch between caller and callee. The caller asked for something the Windows NT kernel (NTSTATUS) could not deliver in the current state. Real Windows bugs that surface as a single NTSTATUS code do exist, but they show up in vendor advisories and KB articles - check the Microsoft Learn page linked under References before opening a support case.

How is 0xC0190056 different from a regular Win32 error like ERROR_ACCESS_DENIED?

Win32 errors are positive integers returned by user-mode APIs; NTSTATUS values like 0xC0190056 live in a different numeric space and are typically returned by kernel-mode or COM-layer APIs. Windows maps between the two with helpers such as HRESULT_FROM_WIN32 and RtlNtStatusToDosError, which is why the same logical failure can surface as several different codes depending on where it was caught.

Related guides worth a look while you sort this one out:

References

Last verified against the official Microsoft error references on 2026-05-25. Confirm against the Microsoft MS-ERREF (NTSTATUS values) before changing production state.

Field notes from real Windows incidents

When I work on the 0xC0190056 symptom the rhythm I lean on is the one I have built over years of these tickets. Windows error codes come in a handful of families; once you recognise the family, the doc page is one search away. STOP codes look terrifying but the first DWORD almost always points directly at the responsible driver. DISM RestoreHealth needs network or a known-good source image; the most common cause of a failed RestoreHealth is a blocked Windows Update endpoint.

Tools I actually reach for

For the 0xC0190056 symptom on Windows the cheapest signal I can land usually comes from Windows Error Lookup Tool (err.exe), then WinDbg for STOP code analysis, Windows Performance Recorder when Windows Error Lookup Tool (err.exe) cannot see the layer the fault sits in, and PowerShell Get-WinEvent for the cases where neither of those answers cleanly. That ordering is not academic. It matches the layers the failure tends to surface through, so the cheap signal lands first and the heavier tooling only comes out when the simpler answer does not hold up under scrutiny.

Verification I run before I close the ticket

Before I mark the 0xC0190056 symptom resolved on a Windows unit, the verification loop below is what I actually run. Each step proves a different layer is green, and the order matters - the cheap checks gate the more expensive ones.

DISM /Online /Cleanup-Image /RestoreHealth

If that one comes back clean, move to the next check. If it does not, stop and dig in there before layering more verification on top of a red signal.

Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=(Get-Date).AddDays(-7)}

If that one comes back clean, move to the next check. If it does not, stop and dig in there before layering more verification on top of a red signal.

wevtutil epl System system.evtx  # export for offline review

Only when every line above runs clean do I close the ticket and update the runbook with the timestamps.

Where I check first when the docs disagree

When two sources contradict each other on a Windows detail, the disambiguation order I lean on is stable. I usually start at techcommunity.microsoft.com/category/windows for the ground-truth view on Windows. I usually start at support.microsoft.com for the ground-truth view on Windows. I usually start at learn.microsoft.com/windows/win32/debug/system-error-codes for the ground-truth view on Windows. Random blog posts and reseller wikis are signal, not ground truth, and I treat them as such until the references above either confirm or contradict the claim.

Pitfalls I have walked into on this exact path

The shortcuts that look smart on the 0xC0190056 symptom have a habit of biting back. The pitfalls below are the ones I have personally walked into on a Windows unit, not things I read about. DISM RestoreHealth needs network or a known-good source image; the most common cause of a failed RestoreHealth is a blocked Windows Update endpoint. Reliability Monitor is the single most underused triage surface in Windows — it gives 30 days of crash history without writing a query. Windows error codes come in a handful of families; once you recognise the family, the doc page is one search away. When in doubt I revert to the slower path that the manual prescribes - the time I save by skipping it is always smaller than the time I spend cleaning up afterwards.

What I tell the next on-call

When I hand the 0xC0190056 symptom off to the next person on rotation, the three lines I leave in the runbook are these. First, the symptom signature for Windows on the Windows family - not a paraphrase, the exact string that surfaces. Second, the diagnostic that gave the highest signal in the least time. Third, the exact verification command whose green output justified closing the ticket. That trio is what turns a one-off fix into a runbook entry the next engineer can use without paging me at three in the morning.

I also add a one-line note on the cost of getting this wrong. For the 0xC0190056 symptom on a Windows unit, the cost is rarely the replacement part. It is the downtime, the second site visit, and the trust deficit you spend with whoever owns the asset when the fix does not hold. That framing keeps the next on-call from choosing the cheap-looking shortcut that ends up costing the most in elapsed hours and goodwill.