Fix 0X000005DD: Event Log Service Won't Start

Quick answer: Delete or rename corrupted .evtx files in C:\Windows\System32\winevt\Logs, then restart the Windows Event Log service. That clears the log files and lets the service start fresh.

You're seeing error 0X000005DD (ERROR_EVENTLOG_CANT_START) because the Event Log service can't open its log files. This happens most often after a sudden shutdown, a disk full error, or when permissions on the winevt folder get messed up. I've seen this on every version from Windows Server 2012 R2 to Windows Server 2022, and on Windows 10 and 11. The logs themselves get corrupted or the service loses access. The fix is straightforward, but you will lose your existing event history. That's the trade-off.

Before You Start

You'll need administrative rights. Log in as an administrator or use an admin account. If you can't log in at all, boot into Safe Mode with Command Prompt. On Windows Server, you might need to start from the installation media to access the command line.

Step-by-Step Fix

Stop the Windows Event Log service. Open Command Prompt as Administrator. Type this and press Enter:
```
net stop EventLog
```
You'll see "The Windows Event Log service is stopping." It might hang here for up to 30 seconds. If it doesn't stop, go to Task Manager, find the service, and end the process. Sometimes a corrupted log file locks the service.
Navigate to the event logs folder. In the same Command Prompt, type:
```
cd C:\Windows\System32\winevt\Logs
```
After pressing Enter, you should be in that directory. Type dir to see the list of log files. You'll see files like Application.evtx, System.evtx, Security.evtx, and more.
Back up the logs (optional). If you need to keep the logs for auditing, copy the folder first:
```
mkdir C:\BackupEventLogs
copy *.evtx C:\BackupEventLogs
```
This takes a minute. If you don't care about old logs, skip this step.
Delete the corrupted log files. In the Command Prompt, run:
```
del *.evtx
```
You'll get a prompt: "Are you sure (Y/N)?" Type Y and press Enter. After that, type dir again. You should see no .evtx files left. If you still see any, delete them individually with del Application.evtx (replace the filename).
Fix permissions on the winevt folder. Corrupted logs sometimes break folder permissions. Run this command:
```
icacls C:\Windows\System32\winevt /grant Administrators:F /T
```
You'll see "processed file: C:\Windows\System32\winevt\..." for each file. This takes a few seconds. The /T flag applies the fix to all subfolders and files.
Restart the Event Log service. In the same Command Prompt, type:
```
net start EventLog
```
You should see "The Windows Event Log service was started successfully." If you still get the error 0X000005DD, reboot the machine. Sometimes the service needs a fresh start after the logs are cleared.
Verify it's working. Open Event Viewer (type eventvwr.msc in Run or search for it). You should see the logs listed under Windows Logs. They'll be empty except for a new entry that says the service started. That's normal.

Alternative Fixes If Step 4 Doesn't Work

Option A: Delete logs from Safe Mode. If you can't stop the service normally, boot into Safe Mode with Networking. The service won't start in Safe Mode, so you can delete the files directly without stopping anything first. Follow steps 2-4 from above.

Option B: Check disk for corruption. If the logs keep getting corrupted, your hard drive might have bad sectors. Run chkdsk C: /f /r from an admin Command Prompt. You'll get a prompt to schedule the check on next reboot. Type Y, then restart. The check can take hours on large drives. After it's done, try the event log fix again.

Option C: Restore default event log permissions. Sometimes group policies mess up permissions. Open Registry Editor (regedit), go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog. Right-click the EventLog key, choose Permissions, make sure SYSTEM and Administrators have Full Control. Apply, then close. Restart the service.

Prevention Tip

This error won't come back if you keep the event logs under 20 MB each. Event Viewer lets you set a maximum log size. Right-click a log (like Application), go to Properties, set "Maximum log size" to 20480 KB. Also check "Overwrite events as needed." That prevents the logs from filling up and getting corrupted during system crashes. On servers with high log volume, set this for the Security log separately. I've done this on hundreds of servers and it stops the problem cold.

Also, never let the system drive run out of space. Event logs need room to write. Keep at least 10% free on the C: drive. If you're tight on space, move the event logs to another drive using the registry tweak in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\File (and the same for System and Security). Change the path to D:\Logs\Application.evtx and so on. Reboot after.