API-MS-WIN-CRT-RUNTIME-L1-1-0.dll — Universal CRT API Set

What API-MS-WIN-CRT-RUNTIME-L1-1-0.dll is

API-MS-WIN-CRT-RUNTIME-L1-1-0.dll is one of many small "API set" forwarder files that redirect specific groups of C runtime function calls to the real implementation in UCRTBASE.dll; API sets let Windows update the underlying CRT implementation without breaking older apps that link against these specific forwarder names. It ships as part of Universal CRT API Set (forwards to UCRTBASE.dll) and lives in C:\Windows\System32 (and SysWOW64 for the 32-bit build) on every Windows 10/11 installation — it is not something Microsoft distributes as a standalone, separately downloadable package.

It is used by applications compiled against the Universal CRT that call basic runtime startup/termination functions through this API-set forwarder rather than directly against UCRTBASE.dll. Because it sits this deep in the operating system, a genuinely missing or corrupted copy is rare and serious — far more often, an error message referencing this file points to a different underlying problem (a failing application, a different corrupted dependency, or malware) rather than this specific file being the root cause.

Why you're seeing an error about it

API-MS-WIN-CRT-RUNTIME-L1-1-0.dll errors are almost always a symptom of one of three situations: an application incorrectly reports it as missing when the real problem lies elsewhere in that program's dependency chain, a Windows system-file corruption issue, or (less commonly but seriously) malware replacing or hooking a core system DLL. None of these are fixed by downloading a replacement file from a random website.

Error messages people search for

Symptoms and messages commonly associated with API-MS-WIN-CRT-RUNTIME-L1-1-0.dll:

• The code execution cannot proceed because API-MS-WIN-CRT-RUNTIME-L1-1-0.dll was not found
• Error appears specifically on Windows 7 systems missing the Universal CRT update (KB2999226)
• Error accompanies a UCRTBASE.dll error on the same system

The correct way to "get" this file back

Since API-MS-WIN-CRT-RUNTIME-L1-1-0.dll is part of the Windows installation itself, the official fix is a repair, not a download:

1. Open Command Prompt or Windows Terminal as Administrator.
2. Run DISM /Online /Cleanup-Image /RestoreHealth first — this repairs the underlying component store that System File Checker pulls clean files from.
3. Once DISM completes, run sfc /scannow. This scans all protected system files, including API-MS-WIN-CRT-RUNTIME-L1-1-0.dll, and automatically replaces any corrupted or tampered copy with a Microsoft-verified version.
4. Restart the computer after the scan completes, even if it reports no issues found.
5. If the error was tied to one specific application rather than system-wide instability, reinstall that application after confirming SFC found no integrity violations.

Breaking down each error

"The code execution cannot proceed because API-MS-WIN-CRT-RUNTIME-L1-1-0.dll was not found"

This is typically caused by the physical file in System32 was overwritten, deleted, or replaced by malware disguising itself under this name. Fix: never replace API-MS-WIN-CRT-RUNTIME-L1-1-0.dll manually — run System File Checker as covered below, which restores the exact Microsoft-signed version for your Windows build.

"Error appears specifically on Windows 7 systems missing the Universal CRT update (KB2999226)"

This is typically caused by a specific version mismatch between this file and the Windows build it's running on, often after an interrupted update. Fix: never replace API-MS-WIN-CRT-RUNTIME-L1-1-0.dll manually — run System File Checker as covered below, which restores the exact Microsoft-signed version for your Windows build.

"Error accompanies a UCRTBASE.dll error on the same system"

This is typically caused by third-party "cleaner" or "optimizer" software removed or altered a file it mistakenly flagged as unnecessary. Fix: never replace API-MS-WIN-CRT-RUNTIME-L1-1-0.dll manually — run System File Checker as covered below, which restores the exact Microsoft-signed version for your Windows build.

Confirming the file is genuine

1. Navigate to C:\Windows\System32\API-MS-WIN-CRT-RUNTIME-L1-1-0.dll in File Explorer.
2. Right-click → Properties → Digital Signatures. It must show Microsoft Windows or Microsoft Corporation as the signer.
3. Check that the file is located exactly in System32 (or SysWOW64) — a copy of a core system DLL sitting in a Downloads folder, a game directory, or any other non-standard location is a strong red flag, not a legitimate variant.
4. If Task Manager or Process Explorer shows a process using a file with this name loaded from anywhere other than System32/SysWOW64, treat it as suspicious and scan the system with up-to-date antivirus software.

Quick reference

If SFC and DISM don't resolve it

• Run Windows Update fully before troubleshooting further — a pending update can leave system files in a temporarily inconsistent state that a fresh scan then resolves on its own.
• Check for malware with Microsoft Defender's full scan or another reputable, up-to-date antivirus product — a system DLL that keeps getting "corrupted" after repeated SFC repairs can indicate active tampering rather than one-off disk corruption.
• Consider an in-place Windows repair install (keeping files and apps) if corruption is widespread across many system files, not just one — this reinstalls the OS files without touching your personal data.
• Rule out failing storage hardware. Recurring, unrelated file corruption across a system is sometimes a symptom of a failing drive rather than a software issue — running a disk health check (e.g. via wmic diskdrive get status or the drive manufacturer's diagnostic tool) is worth doing if problems keep recurring.

Why this file can't just be "reinstalled" like a normal app

Windows Resource Protection (WRP) actively guards a defined set of core system files — including API-MS-WIN-CRT-RUNTIME-L1-1-0.dll — from being overwritten by anything other than a legitimate Windows servicing operation. This is a deliberate security boundary: if any application could silently replace API-MS-WIN-CRT-RUNTIME-L1-1-0.dll, malware could trivially hijack one of the most widely used libraries on the system and intercept or corrupt calls from virtually every running process. That protection is exactly why the correct fix path runs through SFC/DISM rather than a manual file copy — those tools are the officially sanctioned way through that protection boundary, verified against Microsoft's own signed component store.

Reducing the chance of this happening again

• Keep Windows Update enabled — cumulative updates periodically patch and re-verify core system files as part of normal servicing.
• Avoid registry cleaners, "junk file" removers, and unofficial "DLL fixer" tools — the biggest real-world cause of otherwise-healthy system DLLs going missing or corrupted is well-meaning cleanup software being too aggressive.
• Keep an up-to-date antivirus product active, since core-DLL tampering is a known technique used by some malware families to persist or hide.
• If you manage multiple PCs, schedule periodic sfc /scannow runs (e.g. via a scheduled task) so drift gets caught and self-corrected early rather than discovered only after an application starts failing.

How Windows actually keeps this file updated

API-MS-WIN-CRT-RUNTIME-L1-1-0.dll isn't a single static file that only changes when you manually install something — it's serviced through Windows' side-by-side (WinSxS) component store and delivered via cumulative Windows updates. Multiple versions of core system files can exist in the WinSxS store simultaneously to support different Windows builds and app compatibility needs, with the "active" copy in System32 being a hard link managed entirely by the servicing stack. This is part of why manually dropping in a version downloaded from elsewhere is actively counterproductive: it bypasses that entire versioning system instead of working with it.

When Microsoft ships a security fix or bug fix touching this file, it arrives through your normal Windows Update cycle — not as a separate, nameable "driver" or "runtime" release the way MSVCP140.dll or a GPU driver would be. There is no changelog you can check for just this one file; its revision history is folded into the broader Windows cumulative update history for your specific build.

Common myths about this file, debunked

• "I can speed up my PC by deleting unused system DLLs." API-MS-WIN-CRT-RUNTIME-L1-1-0.dll and files like it are loaded on demand and have negligible resource cost when idle. Deleting or moving it does not improve performance — it breaks the applications depending on it.
• "A newer version I found online will fix compatibility issues." Core system files are matched precisely to your Windows build number. A version copied from a different Windows release is more likely to introduce instability than resolve it.
• "DLL fixer tools are a faster alternative to SFC." Third-party "DLL fixer" utilities typically pull files from unverified sources and skip the signature and build-matching checks that SFC and Windows Update perform automatically.
• "If Device Manager and Task Manager show no errors, the file must be fine." Neither tool inspects individual system DLL integrity — that's specifically what SFC and DISM are for, and why they're the recommended check even when nothing else looks obviously wrong.

Notes for IT admins

On managed fleets, scheduling periodic DISM /Online /Cleanup-Image /ScanHealth and sfc /scannow runs (via Task Scheduler, Group Policy startup scripts, or your RMM tool of choice) catches quiet system-file drift before it surfaces as a confusing end-user ticket. If a specific system DLL issue is affecting many machines identically after a particular patch Tuesday, check Microsoft's own release health dashboard for known issues before assuming it's local corruption — occasionally a bug in a cumulative update itself is the actual cause, and Microsoft typically ships a follow-up fix rather than requiring per-machine remediation.

Diagnosing which application is actually affected

If an error mentioning API-MS-WIN-CRT-RUNTIME-L1-1-0.dll keeps recurring, it helps to pin down exactly which process triggers it before jumping to a system-wide repair:

1. Open Event Viewer (search for it in the Start menu) and check Windows Logs → Application for the matching error, noting the exact timestamp and the process name listed as the source.
2. If the error is tied to one specific application rather than happening randomly across many programs, treat that application (its installation, its own dependency chain) as the primary suspect — reinstalling or updating it often resolves the issue faster than a full system repair.
3. For persistent, hard-to-reproduce crashes, Sysinternals' Process Monitor can show exactly which file operations are failing in real time, which is more precise than reading a static error message after the fact.
4. Only escalate to a full sfc /scannow / DISM repair once you've ruled out a single misbehaving application as the actual cause.

Related system components

Frequently asked questions