Fix 0X000010F0: Message Exceeds Max Size in Windows

The 30-Second Fix: Check the Message Size Limit

This error usually hits in one of two places: Event Viewer or an app that sends data to a system API. The first thing I do is check if you're passing a message that's just too damned big.

If you're in Event Viewer, right-click the event and select Event Properties. Look at the Details tab. Is the raw data field huge? Over 32KB? That's your problem. Windows has a hard limit on message size for certain parameters — it's 32KB in most cases, though some APIs cap it lower.

The quickest fix? Trim the message. If it's a script or app you control, don't cram everything into one message. Break it into chunks. For example, in PowerShell:

# Bad - this triggers 0X000010F0 if $message is too large
Write-EventLog -LogName Application -Source MyApp -EventId 1001 -Message $longMessage

# Good - split it
$chunks = [System.Text.RegularExpressions.Regex]::Split($longMessage, '(?<=\G.{32000})')
foreach ($chunk in $chunks) {
    Write-EventLog -LogName Application -Source MyApp -EventId 1001 -Message $chunk
}

If you're using a third-party app and get this error, check the app's config file for a MaxMessageSize or MaxDataSize setting. Microsoft Exchange users — look at the Set-TransportConfig cmdlet. The default max message size there is 10MB, but the error can fire if you're sending an attachment that's too big for the pipeline.

The 5-Minute Fix: Registry Tweak

If trimming the message doesn't work, or if you're seeing this error in system processes like Security Center or Windows Update, the culprit is almost always a corrupt or oversized registry value under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

I've seen this happen when a group policy object pushes a massive list of allowed apps or blocked hashes. The MaxSize or MaxMessageSize value there gets stomped on.

1. Open Regedit as Administrator
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
3. Look for a DWORD named MaxMessageSize — if it's missing, right-click > New > DWORD (32-bit) and name it that
4. Set the value to 65536 (decimal) — that's 64KB, double the default. Or set it to 0 to remove the limit entirely (however, I don't recommend that unless you're testing)
5. Reboot

Don't bother with the EnableEventLog key — it rarely helps. The real fix is giving the API more headroom.

If you're on a domain-joined machine and the error comes back after a reboot, your group policy is pushing a stricter limit. Talk to your AD admin to adjust the relevant GPO. The policy path is Computer Configuration\Administrative Templates\System\Event Logging\Specify the maximum event log size — set it to at least 32768 KB.

The 15+ Minute Fix: Deep System Scan

If you've tried both fixes above and the error keeps firing — especially in Event Viewer itself — you've got a corrupt system file or a misbehaving driver. I've seen this on Windows 10 20H2 and Windows 11 22H2 after a botched update.

Run these commands in an elevated Command Prompt or PowerShell:

sfc /scannow
dism /online /cleanup-image /restorehealth

The DISM command pulls fresh files from Windows Update. Let it finish — it takes 5 to 10 minutes. Then restart and check if the error's gone.

Still there? Time to look at the Event Viewer logs themselves. Corrupt log files can trigger this error. Clear the Application and System logs (they'll rebuild):

1. Open Event Viewer
2. Right-click Windows Logs > Application and select Clear Log
3. Choose Save and Clear if you want a backup, or Clear to just nuke it
4. Repeat for System
5. Reboot

If the error message references a specific service like WSearch (Windows Search) or wuauserv (Windows Update), reset that service's data store. For Windows Search:

net stop wsearch
rd /s /q "C:\ProgramData\Microsoft\Search\Data"
net start wsearch

For Windows Update:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

I've had one client where this error was caused by a third-party antivirus hooking into the message queue — specifically Symantec Endpoint Protection 14.3. Disabling the antivirus temporarily confirmed it. We had to exclude Event Viewer from the AV's behavior monitoring. If you suspect AV, turn it off for 5 minutes and reproduce the error.

If none of this works, you're looking at a deeper issue — possibly a kernel-mode driver corrupting memory. Run verifier.exe (Driver Verifier) but only if you're comfortable with potential blue screens. I'd rather do a repair install of Windows using the Keep personal files and apps option. It takes 30 minutes but fixes 99% of these obscure errors.

Bottom line: 0X000010F0 is almost always a size mismatch. Start with trimming the message, then check the registry. The deep scan is your last resort. I've fixed this on Windows 10 Pro, Windows 11 Enterprise, and Server 2019 — the steps are identical across all of them.