How to fix MicrosoftSecurityApp.exe Bad Image Error 0xc0e90002 in Windows?

Error status 0xc0e90002 in a Bad Image window means a Windows code integrity policy refused to load the DLL that the window names. With MicrosoftSecurityApp.exe in the title, the program is the Microsoft Defender app and the refused file is most often a .NET native image. Read the path in the window first, then rebuild the native images or repair the app.

Facts checked on 14 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What error status 0xc0e90002 means

0xC0E90002 is a Windows NT status code. In the Windows SDK metadata that Microsoft publishes, its name is STATUS_SYSTEM_INTEGRITY_POLICY_VIOLATION. In plain words: a program asked Windows to load a file, and a code integrity policy that is active on the PC did not allow that file.

The sentence around the code misleads. "Is either not designed to run on Windows or it contains an error. Try installing the program again" is the text Microsoft documents for another status, STATUS_INVALID_IMAGE_FORMAT (0xC000007B). Windows reuses that Bad Image window and only swaps the number at the end. So the words describe a broken file, while the number describes a policy decision.

• Spellings. Error status 0xc0e90002, error code 0xc0e90002, error 0xc0e90002 and 0xC0E90002 are the same code. 0xc0e900002 (one zero too many) and 0x0e90002 (the letter c is missing) are typing mistakes for it.
• Check it yourself. Microsoft's App Control troubleshooting page says you can look up a status code with certutil.exe -error. In a Command Prompt, type certutil.exe -error 0xc0e90002.

How to read which DLL the Bad Image window names

Every fix on this page depends on one line of the window: the path of the file. The title is the program that was loading. The path is the file that was refused. Write the path down or take a photo of the screen before you select OK, because the window does not come back on request.

Does the window name a different file each time? That points at the policy or at the reputation check, not at one bad file. Go to Fix 3 and read the log before you reinstall anything.

What MicrosoftSecurityApp.exe is, and what it is not

MicrosoftSecurityApp.exe is the program file of the Microsoft Defender app, the Store app that Microsoft ships with Microsoft 365 Family and Personal subscriptions. Microsoft's support page says the app is installed together with the Microsoft 365 apps, or added by an update if you had them before. That is why many people have it without having asked for it.

App name

Microsoft Defender (Microsoft Store app)

Package name

Microsoft.6365217CE6EB4, as volunteer moderators on Microsoft Q&A report it

Folder in user reports

C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_(version)_x64__8wekyb3d8bbwe\MicrosoftSecurityApp\

Active when

Only after you sign in to it. Microsoft: "Even if it's installed, Microsoft Defender isn't activated until you sign into the app."

Not the same as

The Windows Security app and Microsoft Defender Antivirus, which are built into Windows

We found no Microsoft documentation page that names the file MicrosoftSecurityApp.exe. The link between the file and the app comes from answers by volunteer moderators on Microsoft Q&A and from the folder paths that users post. You can check it on your own PC: open Windows PowerShell and run Get-AppxPackage *6365217CE6EB4*. If the app is installed, the answer lists its name and its install location.

• It is not a virus by its name. A moderator on Microsoft Q&A answered the same worry with "It's not a virus" and pointed to the Store app. A file with this name outside C:\Program Files\WindowsApps\ would be a different matter: scan it (Fix 7).

Which policy refuses the file: Smart App Control, S mode or a work policy

Status 0xc0e90002 always comes from a code integrity policy, and Windows has three common sources of one. Which of them is active on your PC decides what you can do about a refused file.

Smart App Control lets a file load when Microsoft's cloud service predicts it is safe, or when it has a valid signature. Microsoft's developer page adds one detail that matters here: it "evaluates binaries as it loads them". So a program can start fine and still get this window later, at the moment it loads one more DLL.

• Three states. On blocks untrusted files. Evaluation watches and blocks nothing. Off does nothing. You see the state in Windows Security > App & browser control > Smart App Control settings.
• It can switch itself on. After the evaluation period Windows turns it on if it decides you are a good candidate, and sends a notification. An error that began "out of nowhere" on a PC a few weeks old often began that day.
• Turning it back on. Microsoft's FAQ, updated in August 2026, says recent Windows updates allow you to turn Smart App Control on again without a clean installation. Another Microsoft page still says this needs a reset or a reinstall. We could not confirm which builds have the new behaviour.

What causes error 0xc0e90002, from most to least common

For MicrosoftSecurityApp.exe the most common cause is a .NET native image that lost its trust mark. Both cases we could check, the old screenshot of this page and a question on Microsoft Q&A, name System.Xml.Linq.ni.dll in the NativeImages folder. For other programs the usual cause is an unsigned DLL under Smart App Control.

Microsoft explains the mechanism in its App Control documentation. When .NET compiles an assembly into a native image on a PC with a user mode policy, it sets an NTFS extended attribute on the image so that the policy trusts it. That mark is valid only for the policies active at that moment. When a policy is updated, the mark is invalid and the next load of the image is blocked.

How to fix MicrosoftSecurityApp.exe Bad Image error 0xc0e90002

Fix 1 and Fix 2 are for the Microsoft Defender app and end most cases. Fix 3 shows which policy refused the file, which you need before Fix 4. Fixes 5 to 8 repair Windows itself and come last, because they rarely are the cause.

Fix 1. Rebuild the .NET native images with ngen update

10 minutesNo riskThe window names a file that ends in .ni.dll under the NativeImages folder of C:\Windows\assembly.

Microsoft's App Control page names this exact step: run ngen update to make .NET regenerate all native images at once. The new images get a trust mark that is valid for the policies active now, so the load is no longer refused.

1. Type cmd in the search box on the taskbar, right-click Command Prompt and select Run as administrator. Use Command Prompt, not PowerShell, because the commands below use %windir%.
2. Run the update for the 64-bit .NET Framework. Microsoft's Ngen page says native images must be generated by an administrator.

   %windir%\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update

3. When the prompt returns, run the same action for the 32-bit .NET Framework. Microsoft says to run it on all machine architectures.

   %windir%\Microsoft.NET\Framework\v4.0.30319\ngen.exe update

4. Let both commands finish. The window fills with lines about assemblies. Microsoft's page calls updating all images "a lengthy process", so several minutes are normal.
5. Run any work that is still queued, once for each folder.

   %windir%\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems
   %windir%\Microsoft.NET\Framework\v4.0.30319\ngen.exe executeQueuedItems

6. Restart the PC and sign in.

• Lines that say an assembly failed to compile. We could not confirm from Microsoft's page which of these messages matter. Judge by the result: is the Bad Image window gone after the restart?
• A PC with an Arm processor. Microsoft says to cover all architectures. We could not confirm the folder name of the Arm64 .NET Framework from a Microsoft page, so on such a PC use the overnight route from the tip above.

Microsoft also describes what happens while an image is blocked: .NET falls back to the original assembly and compiles it at run time, which costs a little speed and nothing else. That is why the app usually still works after you select OK.

Fix 2. Repair, reset or reinstall the Microsoft Defender app

10 minutesLow riskThe window names a file under C:\Program Files\WindowsApps, the app does not open, or Fix 1 did not stop the window.

A Store app is trusted through the catalog of its package. If the package files or its registration are damaged, the policy can no longer match the files to that catalog. A repair or a fresh install puts back a complete package from the Microsoft Store.

In the list of installed apps look for Microsoft Defender. Do not pick Windows Security: that is the built-in app, and it has nothing to do with MicrosoftSecurityApp.exe.

1. Open Installed apps. Select Start > Settings > Apps > Installed apps.
2. Open the app's advanced options. Find the app in the list, select the three dots next to it and select Advanced options. Some apps do not have this option: for those, see the section about desktop programs below.

   

3. Repair first. On the page that opens, select Repair if it is there. The app's data stays. Open the app and check whether it works.

   

4. Reset if Repair did not help. Select Reset. This deletes the app's data on this PC, including sign-in details and settings. Open the app and set it up again.

These steps were written for Windows 11 25H2 and 26H2. The full page with the other versions and what each result means: How to repair or reset an app in Windows

1. If the window is still there, remove the app. Microsoft's instruction: find Microsoft Defender on the Start menu, right-click it and select Uninstall.
2. Restart the PC.
3. Open the Microsoft Store, search for Microsoft Defender and select Install. Microsoft's support page links to the same Store page.
4. Open the app and sign in with the personal Microsoft account you use for Microsoft 365.
5. Restart once more and watch whether the Bad Image window appears after sign-in.

• The app does not come back by itself. Microsoft: "If you uninstall the app it will not be automatically reinstalled." Install it again in the same session if you use it.
• You never signed in to it. Then Microsoft says the app was not activated. The protection built into Windows is run from the separate Windows Security app, and uninstalling Microsoft Defender does not change it.

Fix 3. Find the block in the CodeIntegrity log and see which policy made it

10 minutesNo riskThe window names a different file each time, a third-party file, or several programs show the same code.

The window shows one path and a number. The CodeIntegrity log holds the rest: which policy refused the file, who signed the file and why the signature did not pass. That decides between Fix 4, an update and a call to your administrator.

1. Right-click Start and select Event Viewer.
2. In the left pane open Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
3. Look at the time when the window appeared and find an event with ID 3077. Microsoft calls it the main block event for enforced policies.
4. Open the event and read File Name (the refused file), Process Name (the program that tried to load it) and PolicyName.
5. Open the events with ID 3089 from the same second. There is one for each signature of the file. Read PublisherName and VerificationError.
6. On Windows 11, list the active policies. Open Terminal (Admin) from the right-click menu of Start and run the command below.

   citool.exe -lp

7. In the output find the policy whose Is Currently Enforced is true and read its Friendly Name.

Fix 4. Update or remove the program that owns the refused DLL

15 to 30 minutesLow riskThe refused file sits in the folder of another product, or the log shows a publisher other than Microsoft.

Overlays, screen recorders, second antivirus products and some utilities load their own DLL into other programs. Under Smart App Control such a DLL must be signed or known as safe. A current, signed build passes the check, and removing the product stops the load attempt.

1. Take the product name from the folder in the path, or from PublisherName in event 3089 (Fix 3).
2. Download the newest version from the publisher's own website and install it over the old one. Newer builds are more often signed.
3. Restart the PC and check whether the window returns.
4. If it does and you do not need the product, uninstall it: Settings > Apps > Installed apps, then More (the three dots) and Uninstall.
5. If you need the product, send its support the file path, the status 0xc0e90002 and the 3077 and 3089 events. Microsoft's advice to developers is short: sign the app with a valid certificate.

Removing a program with every route Windows offers is shown here: Uninstall a program or app in Windows

• No exception list exists. Microsoft: you cannot let one specific app through Smart App Control. An exclusion in your antivirus does not help either, because the block does not come from the antivirus.
• Do not replace the DLL by hand. A copy from a download site has no better signature than the one you have, and may be something else entirely.

Fix 5. Install the waiting Windows and Defender updates

15 to 30 minutesNo riskWindows Update shows pending updates, or the error began after an update that needs a restart to finish.

Microsoft's page about Smart App Control asks for the latest Windows and Defender updates "for the best experience". The policy, the reputation data and .NET Framework all arrive through Windows Update, and a half-finished update can leave them out of step with each other.

1. Open Settings > Windows Update. On Windows 10 it is Settings > Update & Security > Windows Update.
2. Select Check for updates and install everything offered, including updates for .NET Framework and Microsoft Defender.
3. Restart the PC when Windows asks, even if you plan to keep working. A pending restart leaves the update unfinished.
4. Open Windows Update once more and check again until nothing is waiting.
5. If the window named a .ni.dll file, run Fix 1 again after the last restart, because a .NET update makes native images invalid.

Windows 10 left support on 14 October 2025, so a Windows 10 PC without Extended Security Updates no longer receives fixes for Windows itself. If an update fails to install, download it by hand: Install an update from the Microsoft Update Catalog

Fix 6. Repair Windows system files with DISM and SFC

20 to 30 minutesNo riskThe window names a file under C:\Windows\System32 or SysWOW64, or event 3089 shows VerificationError 23.

A Windows file is trusted because its hash matches a signed catalog. If the file is damaged the hash no longer matches, and a policy that requires signed code refuses it. DISM and SFC put back the original files from Microsoft.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

If the window is about .NET files and Fix 1 did not hold, Microsoft offers the .NET Framework Repair Tool for a damaged .NET Framework installation. It is a download from Microsoft, linked from the page "Repair the .NET Framework" in the sources.

Fix 7. Scan for malware when the file sits where no program belongs

15 minutes to several hoursNo riskThe refused file is in a user folder, Temp or Downloads, has a random name, or the status in a window is 0xc0e90007.

Loading an unsigned DLL into a trusted program is a common malware technique, and it is exactly what a code integrity policy exists to stop. When the refused file has no known owner, the window may be the sign that the block worked.

Do not delete the file by hand first. Let the scan find it, so that what started it is found too.

1. Open Windows Security. Select Start, type Windows Security and open the app.
2. Open Virus & threat protection. Select Virus & threat protection. Under Current threats you see when the last scan ran, how long it took and how many files it checked.
3. Run a quick scan. Select Quick scan. If Windows Security thinks a deeper scan is needed, it tells you when the quick scan is done.

   

4. Open Scan options. If the quick scan finds nothing and you still suspect an infection, select Scan options under Current threats.
5. Run a full scan. Select Full scan and start it. It checks every file and program on the device, so it takes much longer than a quick scan. Leave the PC on until it ends.

   

These steps were written for Windows 11 25H2 and 26H2, Windows 10 22H2. The full page with the other versions and what each result means: How to scan for malware with Microsoft Defender

• Also look at Protection history. In Windows Security, Protection history lists what was blocked or quarantined around the time of the window.
• Nothing found and the file is still there. Check its publisher in event 3089 (Fix 3). An unsigned file that no installed program owns should not stay in a startup location.

Fix 8. Go back to a restore point, or reinstall Windows over itself

30 to 90 minutesRead the warningFixes 1 to 7 did not help and the error began on a known day, or Windows files stay refused after DISM and SFC.

System Restore returns system files, drivers and the registry to the state before the day the error began. The repair install from Windows Update replaces every Windows component with a fresh, signed copy and keeps your apps, files and settings.

1. Open System Restore. Press Windows+R, type the command below and press Enter. You can also open Control Panel > Recovery > Open System Restore. If a first page opens, select Next.

   rstrui.exe

2. Choose a restore point. Select a restore point from a time before the problem started. The Description often names the event, such as a driver or app install. If the one you need is missing, select Show more restore points (shown only when there are more).

   

3. See what will change. Select Scan for affected programs. The upper list shows programs and drivers that will be removed; the lower list shows those that might come back and may need to be reinstalled. Select Close.

   

4. Start the restore. Select Next, check the summary and select Finish. Windows restarts and applies the restore point. Do not turn the PC off.
5. Check the result. After sign-in Windows reports whether the restore succeeded. Check whether the problem is gone.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Undo recent changes with System Restore

1. If no restore point exists or the restore did not help, open Settings > System > Recovery on Windows 11.
2. Next to Fix problems using Windows Update, select Reinstall now.
3. Keep the PC plugged in and online while Windows downloads and installs a repair copy of your current version.
4. After the last restart, sign in and check whether the Bad Image window still appears.

The other options on that page, and the route for Windows 10, are here: Reinstall Windows without losing files. Do not choose Reset this PC for this error before you have tried the repair install, because a reset removes your installed programs.

The same error status 0xc0e90002 in OneDrive, games and other programs

Most people who search for this code do not have MicrosoftSecurityApp.exe in the title. The window looks the same for a game launcher, OneDrive, an Xbox component, a video tool or an engineering program. The reading is the same too: title, path, status.

If error 0xc0e90002 is still there: what to collect and whom to tell

When the window survives all fixes, stop changing things and collect evidence. Microsoft's troubleshooting page for App Control lists what its engineers and your administrator need, and Windows 11 has a tool that gathers most of it in one step.

1. Take a screenshot of the Bad Image window with the full path visible.
2. Open Terminal (Admin), which starts PowerShell with administrator rights, and run the collector. Microsoft says it copies the data to %userprofile%\AppData\Local\Temp\DiagOutputDir\CiDiag.

   cidiag.exe /stop

3. If cidiag.exe is missing on your Windows version, save the CodeIntegrity > Operational log from Event Viewer by hand.
4. Save the list of policies next to it. The command is written for PowerShell, like Microsoft's own example.

   citool.exe -lp -json > $env:USERPROFILE\Desktop\CiToolOutput.json

5. Press Win + R, type winver and note the version and the OS build.

• Tell Microsoft. For Smart App Control Microsoft asks for feedback in the Feedback Hub (press Win + F), category Security and Privacy, then Smart App Control. Attach the screenshot.
• Tell the publisher of a third-party file: the path, the status, the 3077 and 3089 events and your Windows build.
• Tell your administrator on a work or school PC. A policy from your organization cannot be changed from your account, and should not be.
• What not to send in public. The CiDiag folder holds event logs and system information of your PC. Send it to the person who investigates, not to a public forum.

Also be honest about the cost. If the app works after you select OK and the window names a native image, Microsoft itself rates the block as functionally benign. Waiting for the next maintenance run is then a valid choice.

How to keep the Bad Image window from coming back

The warning about S mode replaces the first fix of the older version of this guide. Leaving S mode removes one policy for good and cannot be reversed, and it does nothing for a native image that Smart App Control refuses.

Frequently asked questions

What is error status 0xc0e90002?

It is the Windows status code STATUS_SYSTEM_INTEGRITY_POLICY_VIOLATION. A program tried to load a file, usually a DLL, and a code integrity policy on the PC did not allow it. On home PCs that policy is most often Smart App Control in Windows 11. On other PCs it is S mode or an App Control policy from an organization. Windows shows the code in a window titled Bad Image, with the name of the program in the title and the path of the refused file in the text. The file is usually not damaged, although the text of the window suggests it.

Is MicrosoftSecurityApp.exe a virus?

No, not by its name. MicrosoftSecurityApp.exe is the program file of the Microsoft Defender app, a Microsoft Store app that comes with Microsoft 365 Family and Personal. Moderators on Microsoft Q&A answer the same question with "It's not a virus" and point to that Store app. The real file lives in a package folder under C:\Program Files\WindowsApps. A file with the same name in a user folder, in Temp or in Downloads would be suspicious, and you should scan it with Windows Security before you do anything else. The Bad Image window itself is not a sign of an infection.

Does the Bad Image window mean the DLL is damaged?

Usually not. The sentence "is either not designed to run on Windows or it contains an error" is the text Microsoft documents for another status, 0xC000007B. Windows shows the same window for 0xc0e90002 and only changes the number. With 0xc0e90002 the file was refused by a policy, most often because it has no valid signature or its trust record is out of date. Real damage shows up differently: event 3089 in the CodeIntegrity log reports VerificationError 23, an invalid image hash, and Microsoft says that value can indicate file corruption.

Should I turn off Smart App Control to get rid of error 0xc0e90002?

We do not recommend it, and for a Microsoft file it is the wrong tool. A refused .NET native image is fixed by rebuilding the images, and a refused app file by repairing the app. For a third-party file Microsoft itself names the better route: ask the developer to sign the app with a valid certificate. Smart App Control has no exception list for single apps, so switching it off removes the protection for every program. Microsoft's FAQ says recent updates allow turning it on again, but another Microsoft page still says a reset is needed, so do not count on it.

Why does error 0xc0e90002 appear on Windows 11 after an update?

Because updates change the things a native image depends on. Microsoft's Ngen documentation says an update of .NET Framework makes all native images invalid, and Microsoft's App Control documentation says a policy update invalidates the trust mark on every native image. Until .NET has rebuilt the images, a load can be refused with 0xc0e90002. Normally the rebuild runs by itself at night when the PC is idle. If the PC is rarely idle, run ngen update by hand as in Fix 1. A second reason on new PCs: Smart App Control leaves evaluation mode and starts to enforce.

Can I get error 0xc0e90002 on Windows 10?

Yes, but less often. Smart App Control does not exist in Windows 10, as Microsoft's support page states. On Windows 10 the code comes from S mode, which has its own code integrity policy and runs only Microsoft Store apps, or from an App Control for Business policy that an organization deployed. The Microsoft Defender app also exists on Windows 10. The fixes are the same: read the path, rebuild native images, repair the app, read the CodeIntegrity log. Keep in mind that Windows 10 left support on 14 October 2025.

Why does OneDrive or a game show error status 0xc0e90002?

For the same reason as any other program: a file it tried to load was refused by a code integrity policy. The program in the title is only where the load failed. Read the path in the window. If it leads into the folder of another product, such as an overlay, a second antivirus or a mod, that product injected an untrusted DLL, and updating or removing it is the fix. If it leads into the game folder, the game's own DLL is unsigned or was modified. Verify the game files and remove mods. This page is not about OneDrive sync errors with other codes.

What is the difference between error status 0xc0e90002 and 0xc0e90007?

Both come from the same family of system integrity codes, and both appear in the same Bad Image window. The code 0xc0e90002 is the general policy violation: the file was not allowed, most often because it is unsigned or its trust record is invalid. The code 0xc0e90007 carries the SDK name STATUS_SYSTEM_INTEGRITY_REPUTATION_MALICIOUS, which means the reputation check rated the file as malicious. Take that one seriously. Do not look for a way to run the file. Scan the PC with Windows Security, and get the program again from its publisher if you still need it.