Fix ERROR_EVT_FILTER_INVTEST (0x00003AA9) in Event Viewer

This error is a pain, especially when you're hunting down a specific event. Let's kill it.

I've seen the ERROR_EVT_FILTER_INVTEST (0x00003AA9) pop up mostly on Windows 10 22H2 and Windows 11 23H2, usually after you've built a complex custom filter in Event Viewer — maybe you're filtering by Event ID and Source, and then you switch to a different log. Boom. The filter test fails.

Your first instinct might be to restart the Event Log service. Don't bother. It won't fix this error because the problem isn't the service — it's a stale or malformed filter definition stored in memory or in the user's profile.

The quick fix: nuke the custom filter

Open Event Viewer (eventvwr.msc). In the left pane, right-click on Custom Views and select Import Custom View...? No. Wait. That's the wrong direction. We're deleting, not importing. Here's what you do:

Click Custom Views in the left pane.
If you see a custom view that's saved (like "Admin Events"), right-click it and choose Delete.
Now, clear the current filter: go to Action menu > Clear Filter.
Close Event Viewer completely (make sure it's not minimized to the system tray).
Reopen Event Viewer and create a fresh filter. Start simple — just one Event ID or Source — before adding OR conditions.

This works 9 times out of 10. The filter engine in Windows Event Viewer has a known bug where it doesn't properly validate nested conditions in XML query strings. When you delete the custom view and clear the filter, you force the engine to rebuild its internal representation from scratch.

Still broken? Clear the event log cache

If the error persists after resetting the filter, the cached XML query string is corrupted in a deeper layer — probably in the Event Log service's memory or in the log file header. Here's the nuclear option:

Open Command Prompt as Administrator.
Run wevtutil el to list all event logs. Find the log you were filtering (e.g., Application, System, Security).
Clear that specific log with:
```
wevtutil cl "Application"
```
Replace "Application" with your log name. Note: this deletes all events in that log. If you need them, back up the log file first (it's at C:\Windows\System32\winevt\Logs\Application.evtx — copy it before clearing).
Restart the Windows Event Log service:
```
net stop EventLog && net start EventLog
```
Reopen Event Viewer. The error should be gone. Now rebuild your filter.

Why does this work? The 0x00003AA9 error is a validation test failure in the Event Log engine. The engine tries to parse your filter's XML query against the event schema. If there's a mismatch — like a field name that's meant for a different log type, or a missing closing tag in the query — it throws this error. Clearing the log wipes the schema cache and forces a fresh load. It's the software equivalent of turning it off and on again.

Less common variations

Sometimes the error shows up when you're exporting a filtered log to a .evtx file. You click Save All Events as... and get the 0x00003AA9. That's a different animal: the filter is fine, but the export operation has a bug with large result sets (over 10,000 events).

Fix for export errors: Don't use Event Viewer's export. Use PowerShell:
```
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000} | Export-Clixml -Path C:\temp\events.xml
```
This bypasses the GUI's broken export engine entirely.
Another variant: The error appears when you open a saved .evtx file on a different machine (e.g., you collect logs from a server and view them on your laptop). The schema from the source machine doesn't match the local machine's Event Log schema. Solution: install the same Windows version and updates on both machines, or use wevtutil gp to export and import the publisher metadata.

Prevention: stop the error from coming back

Keep filters simple. I know it's tempting to build that 12-conditional filter with nested AND/OR and multiple event IDs. Don't. The Event Viewer filter UI has a character limit (around 32,000 characters in the XML query string) and it often silently truncates long queries. If you need complex filtering, switch to PowerShell's Where-Object or FilterHashtable instead.
Don't mix log sources in a single filter. Filtering across Application, System, and Security in one view is a known trigger for 0x00003AA9. Create separate custom views for each log.
Update Event Viewer. On Windows 10 22H2, Microsoft patched a similar bug in KB5028166 (July 2023). If you're on that build, check for pending updates via Windows Update. On Windows 11, the fix came in KB5029351 (August 2023).
Use wevtutil for quick checks. If you just need to confirm an event exists, run wevtutil qe Application /c:1 /f:text /q:"*[System[EventID=1000]]" — it's faster and won't trigger the filter bug.

That's it. You should be back to hunting your event in under five minutes. If you're still stuck, the Event Log service might be genuinely corrupt — in that case, a sfc /scannow followed by a DISM /Online /Cleanup-Image /RestoreHealth is your next stop. But I've never seen that be necessary for this particular error.