ERROR_INDOUBT_TRANSACTIONS_EXIST (0x00001AAB) Fix

You reboot after a hard shutdown — power cut, kernel panic, or a pulled drive — and the app won't start. Event Viewer shows ERROR_INDOUBT_TRANSACTIONS_EXIST with code 0x00001AAB. Sometimes it's SQL Server refusing to attach a database. Sometimes it's a ReFS or NTFS volume stuck in a "dirty" state. Either way, the message means the transaction manager found a transaction that was mid-commit when the machine went down, and it can't decide whether to roll it forward or back.

I know this error is infuriating — especially when the data on disk looks fine and the app just won't budge. The good news: it's almost always recoverable.

What's actually happening

Windows uses two transaction systems that can throw this error. TxF (Transactional NTFS) handles file operations like rename and delete as atomic units. KTM (Kernel Transaction Manager) sits under it and coordinates. When a transaction is "in doubt," it means the coordinator wrote the prepare phase to disk but never got confirmation that the commit phase finished. A crash in that window leaves a transaction log entry that says "maybe."

On the database side, SQL Server, ESE (used by Exchange and AD), and MSDTC all keep their own recovery logs. If those logs reference a transaction the OS layer can't resolve, you get 0x00001AAB during mount or attach.

The real trigger is a crash — or a forced power-off — during a write-heavy operation. Copying a large VHD, running a big SQL bulk insert, or moving thousands of files with robocopy /MT are the usual suspects.

The fix, step by step

Don't force-mount. Don't run chkdsk /f yet. If you skip this, chkdsk can finish the rollback wrongly and you'll lose the file or row that was mid-commit. Confirm you have a recent backup of the volume or database first.
Check the volume state. Open an elevated command prompt and run:
```
fsutil dirty query C:
```
If it says dirty, that's your starting point. If it says clean but the app still throws 0x00001AAB, skip to step 4 — the problem is at the app layer, not the filesystem.
Let Windows finish the recovery. Reboot normally. Windows runs a lightweight recovery pass on the volume before the desktop loads. On servers, watch the boot screen for "Scanning and repairing drive." Don't interrupt it, even if it takes 20 minutes. Most single-instance indoubt transactions resolve here.
For SQL Server databases, use EMERGENCY mode — carefully. If a DB won't attach with error 0x00001AAB:
```
ALTER DATABASE [YourDB] SET EMERGENCY;
ALTER DATABASE [YourDB] SET SINGLE_USER;
DBCC CHECKDB ([YourDB], REPAIR_ALLOW_DATA_LOSS);
ALTER DATABASE [YourDB] SET MULTI_USER;
```
Yes, REPAIR_ALLOW_DATA_LOSS means what it says. Only do it after you've copied the MDF and LDF files somewhere safe. On a healthy backup, restore instead.
Reset MSDTC if distributed transactions are involved. Stop the Distributed Transaction Coordinator service, then:
```
msdtc -resetlog
msdtc -uninstall
msdtc -install
```
Reboot. This clears the MSDTC log that holds the unresolved transaction. It's heavy-handed but it works when nothing else does.
For ESE databases (Exchange, AD), use eseutil. Stop the service, then run eseutil /r against the log path. Soft recovery replays committed transactions and discards the ambiguous one. If that fails, eseutil /p repairs — but again, that's a last resort before restoring from backup.

If it still fails

Check these in order:

Storage firmware. A controller that lies about flush/FUA behavior will keep producing indoubt transactions on every crash. Dell PERC H730 and older LSI cards with outdated firmware are repeat offenders. Update or disable write-back cache on the array.
Antivirus filter drivers. Third-party filters that hook file operations can inject transactions that never close cleanly. Temporarily uninstall (not just disable) and retest.
Disk health. Run wmic diskdrive get status and check SMART data. A drive reallocating sectors will produce this error intermittently before it dies.
Event log ID 140. If you see NTFS warnings alongside 0x00001AAB, the volume needs offline chkdsk from WinRE — not from a running OS.

Once you've cleared it, enable shadow copies or a proper backup schedule on that volume. The next crash won't be so painful.