Fix Event Log Service Won't Start on Windows

Event Log service fails to start on Windows 10/11 and Server 2016+. The culprit is almost always a corrupted log file. Here's how to force it back up.

Yeah, This Is Annoying — Let's Fix It

You click Event Viewer, it hangs or gives you a blank screen. Or the Event Log service just refuses to start. I've seen this on everything from Windows 10 22H2 to Server 2022. Nine times out of ten, a corrupted .evtx file is blocking the service from loading.

Immediate Fix: Reset the Log Files

Skip the sfc /scannow. Skip the DISM restore health. They waste time. Here's what works:

Open an elevated Command Prompt (right-click Run as Administrator).
Stop the Event Log service:
```
net stop eventlog
```
It might complain it's stopping — that's fine.
Navigate to the logs directory:
```
cd %SystemRoot%\System32\winevt\Logs
```
Rename the current logs to force Windows to create fresh ones. I usually do this:
```
ren *.evtx *.old
```
Start the service back up:
```
net start eventlog
```

That's it. Event Viewer should open clean now. If the service still fails to start, move to the next section.

Why This Works

The Event Log service holds a lock on all .evtx files when running. If a log file gets corrupted — usually from a sudden power loss, disk-full condition, or aggressive antivirus scanning — the service can't parse the file during startup. It hangs or throws Event ID 7023 (The Event Log service terminated with service-specific error). Renaming the files breaks the lock and lets the service create fresh logs. You lose the old logs, but you're not reading them anyway — the service wasn't running.

Less Common Variations

Corrupted System Log Only

Sometimes only one log is bad, like System.evtx or Security.evtx. Instead of nuking all logs, check the Application log (if it opens) for an error referencing a specific .evtx path. Then delete or rename just that file:

cd %SystemRoot%\System32\winevt\Logs
ren System.evtx System.old

Permission Problem

If you get Error 5: Access Denied when trying to stop the service, your SYSTEM account permissions may be hosed. Fix it with:

icacls %SystemRoot%\System32\winevt\Logs /grant SYSTEM:(OI)(CI)F /T

Then try the rename again.

Registry Corruption

Rare, but I've seen it — the service's registry key gets mangled. Open Regedit and verify this key exists and has correct permissions:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog

If it's missing, export the key from a working machine of the same OS version and import it.

Prevention Going Forward

Two things cause this most often:

Low disk space. Windows struggles to write logs when the drive is below 10% free. Keep at least 20GB free on your system drive.
Aggressive AV. Some antivirus tools lock .evtx files during scans. Add the winevt\Logs folder to your AV exclusion list.

Also, consider limiting the max log size in Event Viewer (right-click each log, Properties, set a reasonable max like 20MB instead of the default 1024MB). Smaller logs corrupt less often. I set this on every server I build.

One last thing — if you're on Server Core, the same process works via PowerShell. Use Stop-Service EventLog, Remove-Item on the .evtx files, then Start-Service EventLog.

That's the whole fix. No five-hour rabbit holes. Try it, and you'll be back up in five minutes.