Fix Event Viewer error 0x00003AA4: invalid position

You're scrolling through Event Viewer, trying to find that crash from Tuesday, and Error 0x00003AA4 pops up: "Query result is currently at an invalid position." The list freezes. You can't click anything. Had a client last month whose entire print queue died because of this — they couldn't even open the System log to see the driver failure.

This error happens when Event Viewer's query engine loses track of where it is in the log file. The usual triggers: a corrupted .evtx file, an over-aggressive filter that returns zero results, or the log file was truncated while you were browsing it. I've also seen it after a disk full event — the log got cut off mid-write.

Root cause

The Event Log service uses pointers to navigate through entries. If the log file gets truncated, or metadata doesn't match the actual entries, the pointer lands on a null spot. Event Viewer then throws 0x00003AA4 instead of loading the next record. It's not a hardware failure — it's a corrupted index.

The fix (numbered steps)

Kill the filter first. Click "Clear Filter" in the right pane. Half the time the error is a filter that can't find matching events. If that works, you're done.
Close Event Viewer and reopen it. Simple, but it forces a fresh read of the log. If the error was transient (like a one-time truncation), this fixes it.
Repair the specific log with wevtutil. Open Command Prompt as Administrator and run:
```
wevtutil cl "Application"
```
Replace Application with System or Security or whatever log is broken. This clears the log and re-creates it. Note: This deletes all events in that log. Export them first if you need them.
If that fails, delete the .evtx file manually. Go to C:\Windows\System32\winevt\Logs\, find the log file (e.g., Application.evtx), stop the Windows Event Log service first, then delete the file. Restart the service — it'll create a fresh empty log. I've had to do this for clients whose logs ballooned to 2GB and got corrupt.
Check log size limits. In Event Viewer, right-click a log, go to Properties, and set a max log size (I use 20MB for Application and System, 128MB for Security). Auto-backup and overwrite as needed. Logs over 100MB are asking for corruption.

Still broken? Check these

Disk health. Run chkdsk C: /f if the log is on a failing disk. I once spent an hour troubleshooting a log that wouldn't repair — the drive had bad sectors where the .evtx lived.
Third-party antivirus. Some AV tools (looking at you, McAfee) lock event logs during scans. Temporarily disable the AV and see if the error goes away.
Custom views are corrupt. If you created a custom view (e.g., filtering by EventID 1001), delete it and recreate it. The XML filter can get mangled.

If none of this works, you're probably looking at a system file corruption. Run sfc /scannow and then DISM /Online /Cleanup-Image /RestoreHealth. That's the nuclear option, but it's pulled me out of a few jams.