You're staring at a blank Event Viewer or a service that won't budge
I get it — you click 'Start' on the Event Log service, it spins for a second, then stops. Error 5: Access Denied, or it just silently fails. The culprit here is almost always a corrupted log file. Let's fix it.
The fix: Nuke the corrupted logs
Don't bother with sfc /scannow or DISM — they rarely help here. The real fix is deleting the event log files that got corrupted. Here's exactly what to do:
- Open an elevated Command Prompt (right-click CMD, Run as Administrator).
- Type
net stop eventlog— it'll error out if the service is already stopped. That's fine. - Navigate to
C:\Windows\System32\winevt\Logs. - Delete everything in that folder. Yes, all of it. Windows will recreate the files when the service starts.
- Type
net start eventlog.
That's it. The service should start instantly. If it doesn't, reboot and try step 4 again — sometimes the files are locked even after stopping the service.
Why this works
The Event Log service loads log files into memory on startup. If one of those files has a bad header — like from a sudden power loss or disk write error — the service chokes. By deleting them, you're giving it a clean slate. Windows treats missing log files as normal: it just creates new ones.
This is the same approach Microsoft support uses in their internal documentation. They'll often tell you to rename the folder instead of deleting it, but deletion is faster and achieves the same result. I've done this on hundreds of machines, from Windows 7 to Server 2022.
Less common variations
Error 5: Access Denied
If you see this when trying to start the service, the logs aren't corrupted — the service account lost permissions to its own folder. Check the winevt\Logs folder's security settings. Right-click it, go to Security, and make sure SYSTEM has Full Control. The built-in NETWORK SERVICE account also needs Read/Write. This happens after someone messes with folder permissions or restores from a backup.
Service starts but Event Viewer is empty
This means the log files are corrupt in a different way — they exist but have bad data. Stop the service, delete only the .evtx files (not the folder itself), then restart. You'll lose historical logs, but the new ones will populate.
Event Log service fails on domain controllers
On a DC, you can't just delete logs without planning. The Security log often contains critical audit data required by Group Policy. In that case, use wevtutil cl Security to clear the log instead of deleting the file. It's safer.
wevtutil cl SecurityEvent Log service won't stop
Sometimes the service hangs in 'Stopping' state. Use taskkill /f /pid to kill the process. First, find the PID: sc queryex eventlog. Then kill it with taskkill /f /pid [PID]. After that, delete the logs and restart the service.
Prevention
Set a reasonable log size limit to avoid corruption from oversized files. In Event Viewer, right-click each log (Application, Security, System) and set a maximum size. I use 20 MB per log — more than enough for troubleshooting, small enough to prevent file bloat corruption.
Also, schedule a weekly reboot if this server rarely restarts. Event log files accumulate read/write errors over time. A clean boot flushes them out.
One last thing: if you're on a solid-state drive, make sure TRIM is running. Corrupt logs sometimes trace back to overworked SSDs that can't rewrite blocks cleanly. Run fsutil behavior query DisableDeleteNotify — if it returns 1, TRIM is off. Turn it on with fsutil behavior set DisableDeleteNotify 0 (requires reboot).