Windows cannot load the extensible counter DLL "C:\Windows\system32\sysmain.dll": how to fix it

"Windows cannot load the extensible counter DLL sysmain.dll" is Perflib event 1023 in Event Viewer. A program asked Windows for performance data, and the counter set of the SysMain service could not be loaded. It is not a blue screen and usually not a damaged PC; rebuild the performance counters with lodctr /r first.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What "Windows cannot load the extensible counter DLL sysmain.dll" means

Windows keeps performance counters: numbers such as processor time, disk reads or memory use that tools like Task Manager, Performance Monitor and monitoring programs read. Some of these counters come from extra DLLs that services register. Windows calls them extensible counter DLLs, and the part of Windows that loads them is Perflib, the performance library.

sysmain.dll is the file of the SysMain service, the Windows service that preloads often used programs into memory. When a program asks for all counters, Perflib tries to load the SysMain counter set from that file. If the load fails, Perflib writes event 1023 and the program simply gets no SysMain numbers. Nothing else stops.

The full message as Event Viewer shows it

Windows cannot load the extensible counter DLL "C:\Windows\system32\sysmain.dll" (Win32 error code The specified module could not be found.).

• Extensible counter DLL means a DLL that adds counters to Windows performance data. It does not mean a program is missing.
• The specified module could not be found is what Windows returned when Perflib tried to load the file. Users on Tom's Hardware and Microsoft Q&A report it while sysmain.dll is right there in System32.
• ntdsperf.dll and rdyboost in the same message are other counter sets; rdyboost is the ReadyBoost counter set. Same event, same fixes.
• c:\windows\system32\sysmain.dll is the normal place of the file. Do not download a sysmain.dll from a DLL site to replace it.

Why Windows cannot load sysmain.dll as a counter, most common cause first

The file is almost never really gone. What fails is the link between the counter settings in the registry and the program that reads them. Which cause you have shows in when the event appears.

Is the sysmain.dll error the reason for a blue screen?

On Microsoft Q&A the first thing a Windows MVP asked a user with this event was whether the PC was crashing at all, and the Tom's Hardware user had no blue screen. The event is written at every startup, so it sits next to any crash in the log. A blue screen has its own stop code; read that first.

How to fix "Windows cannot load the extensible counter DLL sysmain.dll"

Fix 1 and Fix 2 take five minutes and stop the event for most readers. Fix 3 repairs system files. Fix 4 is for when one program triggers the event. Fix 5 and Fix 6 are the larger repairs, for when the event comes with other problems.

Fix 1. Read event 1023 and check that sysmain.dll is in System32

5 minutesNo riskAnyone who found Perflib event 1023 in Event Viewer, before changing anything.

The event shows which counter DLL failed and at what moment. If the file is in place and the event lines up with one program, nothing in Windows is missing and the fix is the counter settings or that program, not a new DLL.

1. Press Win + R, type eventvwr.msc and press Enter.
2. Open Windows Logs > Application, then select Filter Current Log in the right pane.
3. In the <All Event IDs> box type 1023 and select OK.
4. Open the newest Perflib event and read which DLL the text names: sysmain.dll, ntdsperf.dll or another one.
5. Note the time, then look at what you started at that time. If it is always the same program, remember its name for Fix 4.
6. Right-click Start, select Terminal (Admin) (Windows 10: Windows PowerShell (Admin)) and run the command below.

PowerShell: does the file exist, and how often was event 1023 written

Test-Path C:\Windows\System32\sysmain.dll
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Microsoft-Windows-Perflib'; Id=1023} -MaxEvents 20 |
  Format-Table TimeCreated, Message -AutoSize -Wrap

Fix 2. Rebuild the performance counter settings with lodctr /r

5 minutesLow riskEvent 1023 comes at startup or with one program, and the file is in System32.

Microsoft documents lodctr /r as restoring the counter registry settings and explanatory text from the current registry and Windows' cached performance files. That rewrites the list Perflib reads, which is where the SysMain entry goes out of step.

1. Type cmd in the search box on the taskbar, right-click Command Prompt and select Run as administrator, then Yes.
2. Save the current counter settings first with the first command below. The file goes to the folder shown in the prompt.
3. Run lodctr /r and read the output. An exit code of 0 only means the command was typed right, so read the text for an error.
4. Restart the PC.
5. Open Event Viewer again as in Fix 1 and check for new 1023 events after the restart.

Command Prompt (Admin): back up, then rebuild the counter settings

cd /d %USERPROFILE%\Documents
lodctr /s:"perf backup1.txt"
lodctr /r

Fix 3. Repair Windows system files with DISM and SFC

20 to 40 minutesLow riskFix 2 did not help, lodctr /r reported an error, or Fix 1 showed the file is missing.

On Microsoft Q&A a Windows MVP reports that the identical sysmain.dll event was solved with System File Checker and DISM, and the accepted answer on Tom's Hardware is the same pair. They put back damaged or missing Windows files, including the counter files Perflib reads.

DISM repairs the store Windows takes clean files from; SFC then replaces damaged files from it. Step by step: Run DISM and SFC to repair Windows system files

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 4. Update or repair the program that triggers the event

10 minutesLow riskFix 1 showed that event 1023 comes only when one program starts, such as a remote desktop client or a monitoring tool.

Perflib loads counter DLLs inside the process that asks for the data. When only one program triggers the event, that program reads every counter set and fails on SysMain. A newer or repaired copy of it may read the counters differently.

1. Close the program fully, also from the notification area next to the clock.
2. Check the maker's site or the program's own update option for a newer version, and install it.
3. If it is already current, repair or reset it in Settings > Apps > Installed apps (Windows 10: Settings > Apps > Apps & features): How to repair or reset an app in Windows
4. Start the program, then check Event Viewer as in Fix 1.
5. If the event still comes with the program and the program works, it is safe to leave: the program simply gets no SysMain numbers.

Fix 5. Install the latest Windows updates

15 to 60 minutesLow riskWindows Update shows pending updates, or the PC has not been updated in a while.

Users first saw the event after a feature update. Cumulative updates replace system files and their counter settings as a set, which can put the SysMain entry back in step.

1. Open Settings > Windows Update (Windows 10: Settings > Update & Security > Windows Update).
2. Select Check for updates and install everything offered, optional quality updates included.
3. Restart, then check again until nothing more is offered.
4. If an update fails, install it by hand: Install an update from the Microsoft Update Catalog

Windows 10 left support on 14 October 2025, so a Windows 10 PC without Extended Security Updates gets no new fixes for this event.

Fix 6. Repair Windows with an in-place reinstall that keeps your files

About 1 hourRead the warningFixes 2 to 5 did not help and Windows has other faults besides this event.

The Microsoft Q&A answer names a repair install as the next step when SFC and DISM do not end it. It puts a fresh copy of your Windows version in place, counter files and settings included, and keeps your files and apps.

1. Open Recovery in Settings. Open Settings > System > Recovery. Next to Fix problems using Windows Update, select Reinstall now. This keeps your apps, files and settings.

   

2. Start the reinstall. Choose whether the PC may restart on its own 15 minutes after the installation, then select OK.
3. Wait and restart. Windows Update downloads and installs a repair copy of your current Windows version. Keep the PC plugged in and online, and restart it when asked.

These steps were written for Windows 11 22H2 and later. The full page with the other versions and what each result means: Reinstall Windows without losing files

If the sysmain.dll error is still there: what to check and what to send

Old 1023 events stay in the log after the fix; only new ones count. If new ones keep coming but the PC works, the cost is one missing set of numbers in a monitoring tool.

• The full event. Open a 1023 event, select Details > XML View and copy the text. It holds the time and the DLL.
• The trigger. Write down which program you start at the time of the event.
• Your build. Press Win + R, type winver and note the version and build.
• The lodctr output. Copy what lodctr /r printed in Fix 2.
• Blue screens. Read Windows Logs > System for Kernel-Power 41 and EventLog 6008 and the errors just before them. Those, not event 1023, point to the cause.

How to keep the extensible counter error from coming back

• Check after big updates. A feature update rewrites counter settings. If event 1023 returns after one, repeat Fix 2.
• Keep the monitoring programs current. Remote desktop clients and system monitors are the programs that read all counters.
• Leave SysMain alone. Turning off the SysMain service is not a fix for this event and changes how Windows preloads programs.
• Never take DLLs from download sites. System files come from Windows itself, through SFC, DISM or Windows Update.

Frequently asked questions

What does "Windows cannot load the extensible counter DLL sysmain.dll" mean?

It means a program asked Windows for performance data and Perflib could not load the counter set of the SysMain service from sysmain.dll. Windows writes this as Perflib event 1023 in the Application log. The program just gets no SysMain numbers; Windows and the SysMain service keep running. It is a log entry, not a crash, and in most cases the file itself is in place in C:\Windows\System32.

What is sysmain.dll, and is it safe?

sysmain.dll is a Windows system file in C:\Windows\System32. It belongs to SysMain, the service that preloads programs you use often so they start faster. It is part of Windows, not malware. A file with the same name in another folder, such as your Downloads or AppData, is not the Windows file; scan it with Microsoft Defender. Never replace the System32 copy with one from a DLL download site.

Can the sysmain.dll error cause a blue screen?

Nothing we read ties event 1023 to a blue screen. The Tom's Hardware user had no crash at all, and on Microsoft Q&A the first question back to a user with this event was whether the PC was crashing. Because the event is written at startup, it sits next to any crash in Event Viewer. For a real blue screen, read the stop code and Kernel-Power 41 in Windows Logs > System.

Why does Windows say sysmain.dll is not found when the file is there?

Users on Tom's Hardware and Microsoft Q&A report exactly this: the file exists in System32 and the event still says the module could not be found. The likely reason is the program that asks for the counters, not the file. A 32-bit program is sent to the 32-bit system folder, where there is no sysmain.dll; we could not confirm this in a Microsoft document. Rebuilding the counters with lodctr /r (Fix 2) is the first fix.

The same error names ntdsperf.dll or rdyboost. Is it the same problem?

Yes. The message is the same Perflib event, only with another counter set in it. rdyboost is the ReadyBoost counter set. The fixes on this page work the same way for them: check the event (Fix 1), rebuild the counter settings with lodctr /r (Fix 2), then run SFC and DISM (Fix 3). If several different DLLs show up at once, Fix 3 is the better first step.

My Windows is not in English. Is "System Windows nie może załadować biblioteki DLL rozszerzalnego licznika" the same error?

Yes. Windows writes event 1023 in the language of the system. The Polish "nie może załadować biblioteki DLL rozszerzalnego licznika", the Spanish "no puede cargar el archivo DLL del contador extensible", the Italian "impossibile caricare la DLL dei contatori flessibili", the Portuguese, Korean, Russian, German and French texts all mean the same thing. The commands in Fix 1 to Fix 3 are typed the same in every language; only the menu names are translated.

Will SFC and DISM fix the sysmain.dll error?

Sometimes. A Windows MVP on Microsoft Q&A reports the identical issue solved by System File Checker with DISM, and that is the accepted answer on Tom's Hardware. Another Windows 11 user ran all the scans, found no corruption, and still got the event. That is why this page starts with lodctr /r, which rebuilds the counter settings themselves, and keeps SFC and DISM as Fix 3.

Should I turn off the SysMain service to stop the error?

No. The event is about loading SysMain's performance counters, not about the service failing. Turning SysMain off changes how Windows preloads programs and is not shown by any source we read to stop event 1023. Rebuild the counter settings with Fix 2 instead. If one program keeps triggering the event and everything works, the event is safe to leave.

Is it safe to ignore Perflib event 1023?

If the PC works, yes. The event only says that a program did not get the SysMain counter numbers. Your files, Windows and the SysMain service are not affected by it. Try Fix 1 and Fix 2 once, because they take five minutes. If the event keeps coming only with one program and that program works, you can leave it.