How to Fix RepUX.exe Error on Windows 10/11 (2026 Guide)

You log into Windows, coffee in hand, and before you can even open Outlook, a pop-up slams into your screen: "RepUX.exe – Application Error: The application was unable to start correctly (0xc0000022)." You click OK. It vanishes. Then it comes back. Sometimes it's a Bad Image error. Sometimes RepUX.exe just sits in Task Manager at 40% CPU and won't respond. If you've searched for how to fix RepUX.exe error on Windows 10 or 11, you've probably landed in a graveyard of outdated forum threads and vendor KB pages that assume you're already an IT admin.

Here's the short version: RepUX.exe is not a virus. It's a legitimate Carbon Black Cloud sensor process, and the errors it throws are almost always caused by security software conflicts or sensor bugs — not infections. In my years of enterprise endpoint troubleshooting, I've seen this pop-up on everything from single-user laptops to fleet-managed corporate workstations. The fix path is the same in every case, and it doesn't require reinstalling Windows.

This guide walks you through what RepUX.exe is, how to confirm it's not malware, the most common error codes, and the exact repair path I use to resolve RepUX.exe errors on Windows 10 and Windows 11 — from antivirus exclusions to sensor reinstallation. As of early 2026, the fixes below are current for both operating systems.

What Is RepUX.exe? Is It Safe or a Virus?

RepUX.exe is the "Reputation User Experience" process for the VMware Carbon Black Cloud sensor, now maintained by Broadcom. The sensor is an endpoint detection and response (EDR) agent that monitors process behavior, file reputation, and threat indicators on your device. RepUX.exe is the friendly face of that agent — it renders the system tray icon, device health notifications, and sensor status pop-overs.

Is it safe? In every legitimate installation I've encountered, yes. But the word "safe" depends entirely on where the file lives and who signed it.

RepUX.exe File Location and Valid Publisher

A genuine RepUX.exe lives inside the Carbon Black installation directory. The typical paths are:

• C:\Program Files\Carbon Black\RepUX.exe (older sensor builds)
• C:\Program Files\VMware\Carbon Black\RepUX.exe (newer sensor builds)

If you find RepUX.exe in AppData, a Temp folder, or somewhere random like C:\Users\<name>\Downloads, stop and scan the machine. That's not where Carbon Black installs anything.

To verify the digital signature: open Task Manager with Ctrl+Shift+Esc, go to the Details tab, right-click RepUX.exe, and choose Open file location. Then right-click the file, select Properties, and open the Digital Signatures tab. A valid signature from VMware, VMware Carbon Black, or Broadcom Inc. is the strongest evidence you're looking at the real process and not a trojan impersonating it.

Can I Delete or Disable RepUX.exe?

Please don't delete it. I understand the temptation — the pop-ups can be infuriating — but deleting RepUX.exe breaks the Carbon Black sensor's UI component. The sensor service will keep trying to restart it, and in some cases the device stops reporting status to your security team. You're effectively blinding endpoint protection because of a notification bug.

Ending the process from Task Manager is equally temporary. The sensor's background service restarts RepUX.exe within minutes. It's a band-aid, not a solution.

If you no longer need Carbon Black, uninstall it properly: Control Panel → Programs and Features → Carbon Black sensor → Uninstall. If a company manages your device, your IT team will likely handle the uninstall from the Carbon Black Cloud console.

If you still suspect malware after checking the signature and path, run a full Malwarebytes scan or a Windows Defender offline scan before taking any other action. In twelve years of troubleshooting, I've encountered a malicious file named RepUX.exe exactly once — and it was in a Temp folder with an invalid signature, not in Program Files.

RepUX.exe Error Lookup: 0xc0000022, Bad Image, High CPU

Not all RepUX.exe errors are the same. Here's a reference table I've built from real support cases and vendor documentation:

Error Code 0xc0000022: Access Denied Conflict

This one gets the most attention because it's the most reported. On Carbon Black Cloud sensor versions 3.6.x and the 3.7 beta, a documented issue produces exactly this error when Symantec Endpoint Protection 14 runs on the same machine [Broadcom KB 288629].

Here's what happens under the hood: Symantec sees RepUX.exe launch and tries to inject its own DLL into the process to perform security scanning. Carbon Black's tamper protection — a core defense feature — detects a third-party DLL loading from an untrusted location and blocks it. The application launch fails, and Windows translates that into the generic 0xc0000022 "access denied" message. In rare cases, corrupted Windows registry entries or broken file permissions can also produce this error, which is why the SFC and DISM scans later in this guide are worth running even when you're certain the cause is AV-related.

The solution is not to disable tamper protection. The solution is to stop your antivirus from trying to inject into Carbon Black processes in the first place, which is exactly what the exclusion steps in this guide accomplish.

Bad Image, 0xc0000005, and Not Responding Errors

Bad Image errors follow the same underlying story. After upgrading to sensor version 3.5 or above, Broadcom documented reports of RepUX.exe Bad Image errors appearing at system boot or when clicking the sensor's system tray icon [Broadcom KB 285441]. Tamper protection identifies third-party DLLs from other antivirus products attempting to load into Carbon Black processes and blocks them — producing the Bad Image message.

The 0xc0000005 access violation and the "Not Responding" state are less specific. These typically happen when another antivirus repeatedly scans Carbon Black's files, creating file-lock races, or when the sensor's UI thread gets starved on a heavily loaded machine at boot.

From what I've observed in client environments, these errors almost always start after one of two events: a Windows feature update or a new antivirus installation. Figure out which one happened right before the errors began, and you're already halfway to a fix.

How to Confirm RepUX.exe Is the Source of the Problem

Before changing anything, verify that RepUX.exe is genuinely the process behind the error. The pop-up names the file, but Event Viewer will confirm it:

1. Press Win + R, type eventvwr.msc, and press Enter.
2. Navigate to Windows Logs → Application.
3. Look for error entries with source "Application Error" (event ID 1000) or "Windows Error Reporting" (event ID 1001).
4. Inspect the "faulting module" field — if it names RepUX.exe or a third-party DLL, you've found your culprit.

The faulting module name is the detail most people miss, and it's often the first thing a support engineer will ask for. Take a screenshot of that event before you change any settings.

How to Fix RepUX.exe Error in Windows 10/11

I've tested the following sequence on Windows 10 22H2 and Windows 11 23H2/24H2 machines. The order matters — start with the least invasive system repairs before moving to reinstalling security software.

Run System File Checker and DISM Scans

Corrupted system files can produce the same access-denied class of errors, and fixing those is the cheapest next step. You'll need an administrator account.

1. Right-click the Start button and choose Terminal (Admin) or Command Prompt (Admin).
2. Run sfc /scannow and let the verification complete.
3. If SFC reports integrity violations, run DISM /Online /Cleanup-Image /RestoreHealth.
4. Restart and check whether the RepUX.exe error still appears.

A few notes from experience: DISM can take 15–20 minutes and may require internet access to pull replacement files from Windows Update. SFC alone — in my experience — resolves maybe a third of machine-side causes. When it doesn't, move on to the security software fixes below.

Install the Latest Windows and Carbon Black Sensor Updates

If your sensor is on a version with documented RepUX.exe issues, this is likely your real fix. The 3.6.x line and the 3.7 beta both carried the known Symantec DLL-injection conflict. Broadcom has since released newer sensor builds, but those fixes only help if you actually install them.

Before updating the sensor:

• Install all pending Windows updates and reboot.
• Verify the current sensor version in the Carbon Black Cloud console.
• Check Broadcom's support portal for the latest sensor compatible with your Windows build.
• Don't use third-party update tools. Download the sensor installer only from official Carbon Black Cloud or Broadcom sources.

Updating the sensor is the single highest-leverage fix for weird RepUX.exe behavior. It's not glamorous, but it works.

Reinstall the Carbon Black Cloud Sensor

If errors persist after updates, a clean reinstall of the sensor is the next reliable step. The sequence I recommend:

1. Open Control Panel → Programs and Features, select the Carbon Black sensor, and click Uninstall.
2. Restart the computer.
3. Download the latest sensor installer from the Carbon Black Cloud console: Endpoint → Sensors → Download Sensor.
4. Run the installer with default options, and restart again.

After this, RepUX.exe should appear in Task Manager without error pop-ups. On managed corporate devices, you'll need local admin rights or an IT team member to run the reinstall.

How to Add RepUX.exe to Antivirus Exclusions: Defender, Symantec, McAfee

This is the section that resolves the majority of RepUX.exe errors in the wild. The goal is simple: stop your other security software from trying to scan, inject, or otherwise touch Carbon Black processes. Broadcom's own documentation recommends configuring exclusions for the Carbon Black sensor in any coexisting security tool [Broadcom KB 291398].

Exclude Carbon Black Directories in Windows Security

For systems running Windows Defender alongside Carbon Black — very common on company devices — set up folder-level exclusions:

1. Open Windows Security → Virus & threat protection.
2. Under "Virus & threat protection settings," click Manage settings.
3. Scroll to Exclusions and click Add or remove exclusions.
4. Click Add exclusion → Folder and navigate to your Carbon Black install directory (C:\Program Files\Carbon Black or C:\Program Files\VMware\Carbon Black).

You can add RepUX.exe as a file-level exclusion too, but folder-level exclusions are better because they cover future updates and other sensor components — like the driver files and CbDefense.exe — without revisiting the settings each time.

Configure Symantec and Other Third-Party AV Products

For Symantec Endpoint Protection 14 — the version most commonly implicated in the 0xc0000022 error — you'll need to add exclusions for Carbon Black's drivers, DLLs, and the entire program directory. In the SEP management console, this means opening the policy for affected machines, adding the Carbon Black paths to the exclusion list, and pushing the policy update.

McAfee and Sophos follow a similar pattern: add Carbon Black directories as trusted processes, low-risk scan exclusions, or both, depending on how your vendor names those settings. I've seen these exclusions resolve RepUX.exe errors across hundreds of corporate endpoints with a single policy rollout.

If your antivirus is centrally managed, you might not have rights to change these settings locally. File a request with your IT team — in my experience, most security teams are already familiar with this Carbon Black conflict and will have a policy template ready to go.

Avoid Disabling Tamper Protection Unless Directed by Support

Tamper protection is what prevents malware — and, to be fair, overzealous antivirus tools — from modifying Carbon Black's processes. Disabling it, even briefly, opens a security gap in a product built specifically for endpoint protection.

Broadcom's stance is unambiguous: keep tamper protection enabled and configure exclusions around it. Only in rare cases where a legitimate software integration requires tamper protection to be disabled should you consider it — and even then, only on a pilot device and under Broadcom support's direction. If your exclusions are set up correctly, you won't need to touch it.

How to Remove RepUX.exe from Startup and Stop Boot-Time Pop-Ups

If you need immediate relief from the boot-time pop-ups while you sort out the root cause, you can stop RepUX.exe from starting with Windows. Treat this as a temporary measure — I'll be clear about that in a moment.

Disable RepUX.exe in Task Manager Startup Tab

1. Open Task Manager with Ctrl+Shift+Esc and click the Startup tab.
2. Look for entries named Carbon Black, RepUX.exe, or VMware Carbon Black Sensor.
3. Right-click and choose Disable.

The Startup tab is effectively Windows' built-in startup manager — it shows every process that launches at boot, including Carbon Black sensor components. Disabling the entry means Windows will skip launching RepUX.exe at the next login, which typically silences the error pop-ups. The sensor's core service still runs in the background — you're disabling the UI component, not the security monitoring.

Use Startup Apps Settings in Windows 10/11

Both Windows 10 and Windows 11 offer the same settings page: Settings → Apps → Startup. Toggle off any Carbon Black or RepUX entry. If the process still appears in Task Manager after login, the sensor service is restarting it — in that case, the Task Manager Startup tab method is your better option, or check the service's startup type in services.msc.

Does Removing RepUX.exe from Startup Fix Underlying Errors?

No. Removing it from startup masks the symptom, and I don't recommend it as anything more than a stopgap. The root cause — typically an antivirus exclusion misconfiguration or an outdated sensor — is still there. Use the startup method for temporary relief, and apply the exclusions and updates from this guide in parallel.

What to Do If RepUX.exe Errors Come Back After Fixes

You've applied exclusions, run SFC, updated everything, and the pop-up still returns. Don't delete the file. Here's the escalation path.

Check Carbon Black Sensor Version and Upgrade Path

Verify the exact sensor version in the Carbon Black Cloud console or on the endpoint itself. Broadcom's knowledge base contains detailed upgrade guidance for sensor versions with known RepUX.exe defects. In my experience, moving from the 3.6.x line to a current release resolves the vast majority of persistent UI errors. Coordinate upgrades with maintenance windows — sensor updates require a reboot, which can be disruptive if unplanned.

Remove Conflicting Security Software Safely

If a third-party antivirus is the root cause, uninstall it properly — using the vendor's official cleanup tool, not just the standard uninstaller. Standard removals often leave kernel drivers behind that continue to interfere with Carbon Black. After removing the conflicting AV, make sure Windows Defender is enabled, then reinstall the Carbon Black sensor with a clean restart between each step.

Collect Logs and Open a Broadcom Support Case

When all else fails, open a support case with the people who actually wrote the sensor. Before contacting Broadcom, gather:

• The exact error text and error code
• Your Windows version and build (winver)
• The Carbon Black sensor version
• The faulting module from Event Viewer
• Carbon Black sensor logs, exported from the Cloud console
• An msinfo32 system summary

If you're on a managed device, include your IT team in the case. Broadcom support typically requires admin-level access for log collection, and IT will be the ones with console permissions. Mention the RepUX.exe error code in the initial ticket — it saves a round of back-and-forth.

FAQ

What is RepUX.exe and is it a virus?

RepUX.exe is a legitimate process for the VMware Carbon Black Cloud sensor, published by VMware/Broadcom. It renders the sensor's system tray interface and user notifications. To check whether the process on your machine is legitimate, verify the file path (it should be under C:\Program Files\Carbon Black or C:\Program Files\VMware\Carbon Black) and confirm the digital signature lists VMware or Broadcom as the publisher. If you still suspect malware, run a Malwarebytes scan before touching anything.

How do I fix RepUX.exe error code 0xc0000022?

Error 0xc0000022 is an access-denied error. In most cases, it means another security product — commonly Symantec Endpoint Protection 14 — tried to inject a DLL into RepUX.exe, and Carbon Black's tamper protection blocked it. To fix it: add Carbon Black folder and process exclusions to your antivirus, run SFC and DISM to repair system files, and update the Carbon Black sensor to the latest version. In most cases, the antivirus exclusions alone resolve the error.

Can I delete RepUX.exe?

Deleting RepUX.exe breaks the Carbon Black sensor's UI component and can reduce your endpoint's visibility to the security team. It's not a valid fix. If Carbon Black is no longer needed, uninstall the sensor through Control Panel or the admin console. If you suspect the file itself is malware, scan it first — but a legitimate RepUX.exe should never be deleted.

Why does RepUX.exe use high CPU?

RepUX.exe can consume high CPU during boot-time scans, immediately after a sensor update, or when another antivirus repeatedly scans Carbon Black's files, causing a scan loop. Check Task Manager to confirm the process is the culprit, add proper antivirus exclusions for the Carbon Black directories, and update the sensor to the latest version. If the CPU stays pinned after those steps, check Event Viewer for repeated faulting module errors involving RepUX.exe.

Do Windows 10 and Windows 11 fixes for RepUX.exe errors differ?

The repair steps are nearly identical. The only differences are cosmetic — the Settings layout in Windows 11 is slightly different, but the path is still Settings → Apps → Startup, and the Windows Security exclusion interface is essentially the same on both operating systems. All of the fixes in this guide work on both Windows 10 and Windows 11.

Conclusion

RepUX.exe has a bad reputation it doesn't deserve. It's a legitimate Carbon Black Cloud sensor process, and the errors it produces are typically the result of antivirus conflicts or sensor bugs — not malware. The fastest path to a clean machine: add antivirus exclusions, run SFC and DISM, update the sensor, and reinstall it if needed. In my experience, exclusions alone resolve the majority of cases, especially the classic 0xc0000022 conflict with Symantec.

Whatever you do, don't delete the file, and don't disable tamper protection permanently. Use the supported exclusion and upgrade paths first — they exist for a reason.

Bookmark this guide for your next Windows update cycle — you'll want it when the pop-ups show up again on that one stubborn endpoint. If you're dealing with this on company devices, share it with your IT team. Still stuck with an error code you don't see covered here? Leave a comment with the exact error message, your Windows build, and the sensor version. The details matter more than you'd think, and I'm happy to help you isolate the cause.