Showing results for 
Search instead for 
Did you mean: 

Error code 3221225539 in AMP



Quarantine failed events were triggered for the user.

Error details for the events are shown below:

Can anyone please explain the meaning of the error?

11 Replies 11

Rising star
Rising star

I found a similar question in the Cisco Support Community that may be helpful.

SourceFire AMP - Cisco Support Community

Kelli Glass

Moderator for Cisco Customer Communities

Cisco Employee
Cisco Employee

That's the Windows error code that AMP received when it attempted to quarantine the file.

The most common reason for quarantine failure is that there is another third-party AV tool (for example, Windows Defender) installed, and that other tool removed the file before AMP could get to it.  This is not a problem from an operational standpoint; AMP correctly detected the threat, and the threat is now neutralized.

If you are encountering other problems, you might consider opening a support case.

w do I open a support case for AMP 4E?  THis is not a product . 

Hello @Kewal sharma,

if there is any unexpected behavior where you need more technical deep dive background, opening a TAC case can help to answer these questions.

What do you mean with "AMP4E is not a product"??



Matthew Franks
Cisco Employee
Cisco Employee

That error is a Windows STATUS_SHARING_VIOLATION error.  I suggest looking on the Microsoft Support Community site for additional information on what can cause this error.





Agree with @matt,

the error code indicates the following. Btw, i have seen such "challenges" also with other AV products, where an engine does not get exclusive access rights to a file on the disk.

  • Error Code in Decimal: 3221225539
  • Possible Reason: Attempted open operation conflicts with an existing open

If you translate the DEC to HEX, your are getting the following result: C0000043
In the Microsoft Documentation ( this Error Code shows the following information.Bildschirmfoto 2019-06-11 um 17.07.34.png






Reasons can be

  • File is opened by another process, so AMP does not get a file handle from the OS.
  • File was already removed from the disk (also often happens with temporary files)


Are you still seeing this error codes?




I am new to AMP and I have already gone through AMP user Guide and got the basic understanding.


Right now, My concern is my AMP Dashboard, where I have 54 Events which require attention and need to Troubleshoot.


Events type are "System Process Protected, Executed Malware & Threat Detected". If Possible, can anyone suggest whether  I have to do anything to clear these events and If yes, then wht steps do i need to take.


Hello @Kewal sharma,

your local responsible Cisco Partner or a Cisco Systems Engineer should be able to go through your results. 
If not, just send me a message, so i can support you.


Based on the Events, YES, there someone should take a deeper look into your environment.




Thanks Thorsten, That would be very helpful if I can get the support from your end.

Cisco Employee
Cisco Employee

3221225539 Error refers to "Attempted open operation conflicts with an existing open"

The file is already opened by another application meaning you should track down which application is using it.

Let me know if you need further assistance.



Rachel Gomez

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: