How to Fix the SecurityHealth "Bad Image" Error (Status 0xc000012f) on Windows

If you've been greeted by a popup that says something like "C:\Windows\System32\SecurityHealthSystray.exe, Bad Image" followed by the cryptic status code 0xc000012f, you're not alone. This error has been tripping up Windows 10 and Windows 11 users for years, and while it looks alarming, it's almost always fixable without reinstalling Windows. In this guide, I'll walk you through exactly what's causing this, and I'll give you every fix from the quick one-liners all the way to the deep-dive repair methods, in plain English, step by step.

What Is the SecurityHealth Bad Image Error, Really?

Before we start throwing commands at the problem, let's make sure we understand what we're dealing with. The "Bad Image" error in Windows means that Windows tried to load a program or a DLL (Dynamic Link Library, think of it as a shared building block that many programs use) and something about that file was wrong. The file might be corrupted, it might have been replaced with an incompatible version, or it might be outright missing a dependency it needs to run.

In this specific case, the program that's complaining is SecurityHealthSystray.exe, the system tray component of Windows Security (formerly Windows Defender). This is the little shield icon you see in your taskbar notification area. When Windows tries to load it at startup, it reaches out for a DLL or a supporting file, finds something wrong with it, and throws up this error box before you even get to use your computer.

The status code 0xc000012f specifically translates to STATUS_INVALID_IMAGE_FORMAT. In plain terms: Windows found the file it was looking for, but the file's internal format is broken or incompatible with your current Windows build. This is different from a "file not found" error, the file exists, it's just damaged or in the wrong state.

Heads Up: Because SecurityHealth is part of Windows Defender, a broken SecurityHealth component means your antivirus and real-time protection may not be running properly. Don't ignore this one, get it fixed today.

Why Does This Error Happen? The Most Common Causes

Understanding the root cause helps you pick the right fix. Here are the most frequent culprits behind the SecurityHealth 0xc000012f error:

1. A Windows Update That Went Sideways

This is the number one cause. Windows updates sometimes partially install, maybe your PC lost power mid-update, the update servers had a hiccup, or a file on your disk had a bad sector at exactly the wrong moment. The result is that some Windows system files get replaced with new versions while others don't, leaving mismatched DLLs that can no longer talk to each other properly.

2. Third-Party Antivirus Conflicts

If you installed a third-party antivirus (Avast, Norton, McAfee, Bitdefender, etc.) and then uninstalled it, or even if it's still installed, its removal process can sometimes delete or quarantine DLLs that Windows Security also depends on. Some antivirus uninstallers are notoriously messy in this regard.

3. Malware or a Failed Malware Removal

Ironically, malware sometimes targets Windows Security components specifically to disable your defenses. A virus or rootkit might have corrupted or replaced SecurityHealth-related files. Even if you've since cleaned the malware, the damage to those files remains.

4. Disk Errors and Bad Sectors

If your hard drive or SSD has failing sectors, system files stored on those sectors can become corrupted over time. This is more common on older spinning hard drives, but SSDs can fail too, especially budget models or older ones with heavy write cycles.

5. A Corrupted Windows Image (WIM)

Windows keeps a local reference copy of critical system files. If that reference copy itself is damaged, Windows can't use it to repair other files, and problems compound over time.

6. Microsoft Visual C++ Redistributable Issues

SecurityHealth components rely on certain Visual C++ runtime libraries. If those packages are corrupted, missing, or mismatched, you'll see exactly this kind of "Bad Image" error pointing at a runtime DLL.

Before You Start: Quick Checklist

Run through these quick checks first, they take about two minutes and can save you a lot of time:

  • Are you running Windows 10 or 11? All fixes in this guide apply to both unless I say otherwise.
  • Is Windows fully up to date? Open Settings → Windows Update and install any pending updates first. Sometimes Microsoft has already patched the root cause.
  • Do you have a second antivirus installed? If yes, note which one, we'll need that information later.
  • Did this start after a specific action? A recent update, a new software install, or a malware removal? Knowing the trigger helps narrow down the fix.

Step-by-Step Fixes (Start Here, Work Top to Bottom)

I've ordered these fixes from simplest to most involved. Most people fix this problem at step 2 or step 3. Work your way down and stop as soon as your error goes away.

Step 1
Restart Windows, But Do It Properly

I know this sounds obvious, but there's a trick here. Windows 10 and 11 use "Fast Startup" by default, which means the "Shut Down" button doesn't actually do a full shutdown, it hibernates the kernel state. This means corrupted state from a bad update can persist across what looks like reboots.

To do a true, full restart: click Start → Power → Restart (not Shut Down). Alternatively, hold Shift while clicking Shut Down. Wait for the machine to fully power off and come back on. Then check whether the error reappears.

Tip: If this is the first time you're seeing this error and you haven't rebooted since a Windows Update ran overnight, a proper restart will fix it about 15% of the time. Simple, but worth doing first.
Step 2
Run the System File Checker (SFC)

The System File Checker is Windows' built-in tool for scanning and repairing corrupted system files. It compares every protected system file against a known-good cached copy and replaces any damaged ones it finds. This is the fix that works most often for this specific error.

Here's how to run it:

  1. Press Windows Key + S and type cmd.
  2. Right-click on Command Prompt in the results and choose Run as administrator. Click Yes if UAC prompts you.
  3. In the black window that opens, type exactly this and press Enter:
    sfc /scannow
  4. Wait. This takes 5–20 minutes depending on your system. Don't close the window or shut down your PC.
  5. When it finishes, you'll see one of three messages:
    • "Windows Resource Protection did not find any integrity violations.", Your system files are clean. Move to Step 3.
    • "Windows Resource Protection found corrupt files and successfully repaired them.", Great news! Restart and test.
    • "Windows Resource Protection found corrupt files but was unable to fix some of them.", Move on to Step 3 immediately, as DISM can help where SFC can't.
Tip: After SFC finishes, you can review the detailed log at C:\Windows\Logs\CBS\CBS.log. Open it in Notepad and search for "[SR]" to see exactly what was found and what was repaired.
Step 3
Run DISM to Repair the Windows Image

DISM (Deployment Image Servicing and Management) operates at a deeper level than SFC. While SFC repairs individual files using a local cache, DISM goes out to Windows Update servers to download fresh, verified replacement files and restore your Windows installation image itself. If SFC found corrupt files it couldn't fix, DISM is the next step.

Keep that administrator Command Prompt open from Step 2 and run these commands in order, wait for each one to finish completely before running the next:

  1. First, check the image health:
    DISM /Online /Cleanup-Image /CheckHealth
  2. Then scan more deeply:
    DISM /Online /Cleanup-Image /ScanHealth
    (This one can take 10–30 minutes, be patient.)
  3. Finally, restore the image:
    DISM /Online /Cleanup-Image /RestoreHealth
    (This downloads replacement files from Microsoft and can take 20–45 minutes. Make sure you have a stable internet connection.)

Once DISM completes successfully, run SFC one more time to let it apply repairs using the now-restored image:

sfc /scannow

Restart your PC and check whether the SecurityHealth error is gone.

Warning: Don't interrupt DISM partway through. If it says it's stuck at a percentage for a long time, let it keep going, it's downloading and verifying files in the background and may genuinely be working. Interrupting it can make things worse.
Step 4
Repair or Reinstall Microsoft Visual C++ Redistributables

The SecurityHealth components depend on Visual C++ runtime DLLs. If those are corrupt, you'll get exactly this error. Here's how to fix them:

  1. Press Windows Key + R, type appwiz.cpl and press Enter. This opens Programs and Features.
  2. Look for entries named Microsoft Visual C++ Redistributable. You'll likely have multiple versions (2015, 2017, 2019, 2022) in both x64 and x86 variants. That's normal.
  3. For each one, click it and choose Change (or Repair if available). Follow the prompts to repair the installation.
  4. If you don't see a Repair option, you'll need to uninstall and reinstall. Download the latest Visual C++ Redistributable packages directly from Microsoft's official website (search for "Microsoft Visual C++ Redistributable latest supported downloads").
  5. Install all available versions, both x64 and x86 for each year. Restart when done.
Step 5
Re-register Windows Security / Reset Windows Defender

Sometimes the SecurityHealth components themselves need to be re-registered with Windows. This process tells Windows to rebuild its internal database of what files belong to the Windows Security system.

  1. Open an administrator PowerShell window (search for PowerShell, right-click, Run as administrator).
  2. Run this command to re-register the Windows Security app:
    Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
  3. Wait for it to complete (no output means it worked), then restart your PC.

This command tells Windows to completely reset the Windows Security UI package, which includes SecurityHealthSystray.exe and its dependencies. Think of it as a factory reset specifically for the Windows Security app, without touching anything else on your system.

Step 6
Check Disk for Errors

If none of the above have worked, there may be underlying disk corruption that's causing files to become damaged repeatedly. It's time to check your drive.

  1. Open an administrator Command Prompt.
  2. Type the following command (replacing C: with your Windows drive letter if different):
    chkdsk C: /f /r
  3. You'll be told that the drive is in use and asked if you want to schedule the check for next restart. Type Y and press Enter.
  4. Restart your PC. Before Windows loads, CHKDSK will run automatically. This can take anywhere from 10 minutes to over an hour depending on your drive size and how many errors are found.
  5. After it completes and Windows boots, check whether the SecurityHealth error is gone.
Warning: If CHKDSK reports finding and fixing a large number of bad sectors, that's a sign your hard drive may be failing. Back up your important files immediately and consider replacing the drive, repaired bad sectors tend to spread.
Step 7
Clean Up Third-Party Antivirus Remnants

If you've ever had a third-party antivirus installed (and especially if you uninstalled it recently), its leftover files or drivers may be conflicting with Windows Security. Standard uninstallers often miss files and registry entries.

  1. Visit the website of your former antivirus vendor and download their official "removal tool" (each major vendor has one, search for "[antivirus name] removal tool").
  2. Run the removal tool in Safe Mode for best results (hold Shift while clicking Restart → Troubleshoot → Advanced Options → Startup Settings → Restart → press 4 for Safe Mode).
  3. After running the removal tool and restarting normally, run SFC again to repair any files the antivirus may have taken with it.

Advanced Troubleshooting: When the Standard Fixes Don't Work

If you've worked through all seven steps above and you're still seeing the error, it's time to go deeper. Here are the advanced techniques I use when standard repairs fail.

Check the Windows Event Viewer for the Real Error

The popup you see is a summary. The real technical details live in Event Viewer, and they often point to the specific DLL that's causing the problem.

  1. Press Windows Key + R, type eventvwr.msc, press Enter.
  2. In the left pane, navigate to Windows Logs → Application.
  3. Look for Error events with a source of SideBySide or Application Error that occurred around the time you get the popup.
  4. Click on an error to read the full details. Look for a line that says something like "Dependent Assembly ... could not be found", this names the exact DLL that's missing or broken.

Once you know the exact DLL name, you can search for it specifically, look up whether it belongs to a particular package (like Visual C++ or .NET), and target your repair efforts precisely.

Use the Windows 11/10 Repair Install (In-Place Upgrade)

This is the most powerful repair option short of a clean install. A repair install (also called an in-place upgrade) reinstalls Windows completely while keeping all your personal files, settings, and installed programs intact. It replaces every single Windows system file with a fresh copy.

  1. Go to Microsoft's official Windows download page and download the Media Creation Tool for your Windows version.
  2. Run the tool and choose Upgrade this PC now.
  3. Follow the wizard. When it asks what to keep, select Keep personal files and apps.
  4. The process takes 45–90 minutes and will restart your PC several times. This is completely normal.
Tip: A repair install does not activate a new license. Your existing Windows activation carries over. You also don't lose your installed programs, unlike a clean install. This is a major tool that many users don't know about.

Create a New Windows User Account to Isolate the Problem

Sometimes a corrupted user profile (not the system itself) can cause SecurityHealth issues. Create a fresh local account to test:

  1. Open Settings → Accounts → Family & other users → Add someone else to this PC.
  2. Choose "I don't have this person's sign-in information" → "Add a user without a Microsoft account."
  3. Create a simple username and password, sign out, and sign into the new account.

If the error doesn't appear on the new account, the problem is isolated to your user profile. You can migrate your files to the new account and eventually delete the old corrupted one.

Check for Malware with Windows Offline Scan

If you suspect malware tampered with your SecurityHealth files, run Windows Defender's offline scan, this scans before Windows fully loads, catching rootkits that can hide from regular scans:

  1. Open Windows Security (search for it in the Start menu).
  2. Go to Virus & threat protection → Scan options.
  3. Select Microsoft Defender Offline scan and click Scan now.
  4. Your PC will restart and scan before Windows loads. Results will be shown when you boot back into Windows normally.

Manually Replace the Problematic DLL

This is a last resort before the repair install, and requires some care. If Event Viewer told you the specific DLL name, you can copy a clean version from another working Windows machine (same version and build) or extract it from a Windows ISO file.

  1. Note the exact DLL name from Event Viewer.
  2. Boot into Windows Recovery Environment (hold Shift during restart → Troubleshoot → Advanced Options → Command Prompt).
  3. Use the copy command to replace the damaged file with a clean copy from a USB drive or mounted ISO.
Warning: Manually replacing system DLLs with mismatched versions can make things worse. Only do this if you are 100% certain the replacement file is from the exact same Windows version and build number as your system. When in doubt, use the repair install instead.

How to Prevent This Error From Coming Back

Once you've fixed the SecurityHealth 0xc000012f error, let's make sure you don't have to deal with it again. These habits will keep your Windows installation healthy long-term.

Keep Windows Updated, But Monitor Updates

Most of the time, Windows Updates fix problems. But occasionally a bad update introduces them. Enable Windows Update but check the Windows release health dashboard (search for it on Microsoft's site) before installing major updates if you want to be cautious.

Use Windows Security as Your Primary Antivirus

Windows Defender / Windows Security has become genuinely excellent in recent years. For most home users, it's all you need. Using a third-party antivirus alongside it can create conflicts, including exactly the kind of DLL issues we've been dealing with here. If you do use a third-party antivirus, use it exclusively and disable Windows Defender through that software's settings (most do this automatically).

Run SFC Monthly as Maintenance

Make it a monthly habit to open an administrator Command Prompt and run sfc /scannow. It takes 10–20 minutes and silently fixes small file corruptions before they compound into bigger problems. Set a calendar reminder.

Keep an Eye on Your Drive's Health

Install a free tool like CrystalDiskInfo (safe, widely recommended, been around for years) and check your drive's S.M.A.R.T. health data occasionally. Watch for rising "Reallocated Sectors Count" or "Pending Sector Count" values, those are early warning signs that a drive is starting to fail.

Create a System Restore Point Before Major Changes

Before installing new software, making registry changes, or installing antivirus products, create a system restore point: search for "Create a restore point" in the Start menu and follow the prompts. If something goes wrong, you can roll back to that point.

Don't Use "Registry Cleaner" Software

Registry cleaners (CCleaner's registry feature, RegCleaner, etc.) are a common source of exactly these kinds of DLL and component errors. They delete registry entries that look unused but are actually relied upon by Windows components like SecurityHealth. Avoid them entirely.

Frequently Asked Questions

Is the 0xc000012f error a virus?
Not directly, 0xc000012f is a Windows status code meaning "invalid image format," not malware itself. However, malware can cause this error by damaging or replacing system files. If standard repairs (SFC, DISM) don't fix it and you have other signs of infection, run the Windows Defender offline scan as described in the advanced troubleshooting section.
Will I lose my files if I do the repair install?
No, the in-place repair install (also called an in-place upgrade) is specifically designed to keep all your personal files, settings, and applications while only replacing Windows system files. That said, always back up important files before any major Windows repair operation. Accidents and power outages can happen at the worst moments.
The error only appears at startup and goes away on its own. Should I still fix it?
Yes, absolutely. An error that dismisses itself is still an error. SecurityHealth failing at startup means Windows Security may not be initializing properly, which could leave gaps in your real-time protection even if the shield icon eventually appears in the taskbar. Fix it properly rather than just clicking OK every morning.
I ran SFC and it said "no integrity violations" but I still get the error. What now?
SFC checks a specific set of protected Windows files. The problem might be with an application package (like the Windows Security app package) rather than a core system file. In this case, the AppX reset command in Step 5 is often more effective: Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage. Also check Event Viewer for the specific DLL name, it might be a Visual C++ runtime issue, not a system file issue.
DISM says it failed or couldn't connect to Windows Update. What do I do?
This usually means DISM can't reach Microsoft's servers to download repair files. First, check your internet connection and temporarily disable your firewall/VPN. If that doesn't help, you can point DISM at a local Windows ISO file instead: mount the ISO (right-click → Mount), then run DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:X:\sources\install.wim:1 /LimitAccess where X: is your mounted ISO drive letter. This makes DISM use the ISO as its repair source instead of the internet.
The error mentions a specific DLL file, not SecurityHealthSystray.exe itself. What does that mean?
That's actually helpful, it narrows down the problem. SecurityHealthSystray.exe is the program that's running, but it's failing because a DLL it depends on is corrupt or missing. The DLL name in the error message tells you which component is broken. Common ones include runtime DLLs from Visual C++ Redistributables (like MSVCP140.dll or VCRUNTIME140.dll), which you can fix by repairing or reinstalling those redistributables as described in Step 4.
Can I just disable SecurityHealthSystray.exe from starting up to get rid of the popup?
Technically yes, you could remove it from startup using Task Manager → Startup tab. But this doesn't fix the problem, it just hides it. SecurityHealthSystray.exe is the system tray icon for Windows Security, and disabling it means you won't have the taskbar shield icon or its associated alerts. More importantly, the underlying file corruption that causes the popup is still present and may cause other issues. Fix the root cause rather than suppressing the symptom.
I'm on Windows 11, do any of these steps work differently?
The core repair commands (SFC, DISM, CHKDSK) work identically on Windows 10 and Windows 11. The AppX reset command in Step 5 also works on both. The main difference is the Settings app UI layout, some menu paths are slightly different in Windows 11's redesigned Settings, but the functionality is the same. If you can't find a setting, use the search bar within Settings, it covers both versions well.

Wrapping Up

The SecurityHealth "Bad Image" error with status 0xc000012f is frustrating because it hits you right at startup and involves a critical security component, but it's almost always repairable without reinstalling Windows from scratch. In the vast majority of cases, running sfc /scannow followed by DISM RestoreHealth and a restart is all it takes.

If you're still stuck after working through everything here, the in-place repair install is your nuclear option, it replaces every Windows system file while keeping your stuff, and it resolves even the most stubborn corruption issues.

Got a specific error message variant or a DLL name in your popup that I haven't covered? Drop it in the comments below with your Windows version and build number, and I'll help you track it down.