Fix ERROR_LOG_BLOCK_INCOMPLETE (0X000019CB) on Windows Server

You're running a Windows Server 2019 or 2022 box, maybe a Domain Controller or a file server, and suddenly the Event Viewer starts throwing ERROR_LOG_BLOCK_INCOMPLETE (0X000019CB) errors every few minutes. Sometimes the server even shows a 0x19CB stop code during boot. I've seen this most often after an unexpected power loss or a disk that's been throwing SMART warnings for weeks but no one checked. The log service—either the NTFS $LogFile or the Event Log—tries to write a block of data, but only part of it makes it to disk. The rest is garbage or missing. That's the incomplete block the error name refers to.

What actually causes this?

At a low level, the log service writes data in fixed-size blocks. If a write operation gets interrupted—say the disk cache flushes mid-write, or the drive firmware retires a bad sector—the block lands on disk partially filled or with mismatched checksums. Windows sees a block that doesn't match its expected size or signature and flags it as 0x19CB. It's not a bug in Windows itself. It's the OS telling you the storage layer is lying to it.

The two most common offenders are:

• The Event Log files — System.evtx, Application.evtx, or Security.evtx. These get corrupted if the server crashes while writing event entries.
• The NTFS $LogFile — the transactional log on every NTFS volume. If that's corrupt, the error appears during disk operations, not just in Event Viewer.

How to fix it — step by step

Skip the registry tweaks. Skip reinstalling the OS. Here's what actually works.

Step 1: Identify which log is corrupt

Open Event Viewer and look at the details of the 0x19CB event. If the source says Ntfs or Disk, it's the NTFS log. If it says EventLog, it's the Event Log files. Run this in PowerShell to see the last 5 events with that code:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=0x19CB} -MaxEvents 5 | Format-List

Write down the LogName and Provider fields. That tells you where to aim.

Step 2: Repair the NTFS $LogFile

If the provider is Ntfs, run chkdsk on the affected drive. Do not use /f alone—you need /r to also fix bad sectors. On a server you can't reboot immediately, run:

chkdsk C: /r /scan

The /scan flag runs online in Windows 10/Server 2016 and later. If that doesn't help, schedule a full offline check with:

chkdsk C: /r /f

Then reboot. The scan will take a while depending on disk size. After it finishes, check if the error recurs.

Step 3: Clear and rebuild the Event Log

If the issue is in an Event Log file, you need to clear it. Yes, you lose the history, but a corrupt log file keeps throwing errors and can hang the Event Log service. Open an admin PowerShell and run:

wevtutil cl System
wevtutil cl Application
wevtutil cl Security

Clear only the log that's corrupt. If you're not sure, clear all three—they're safe to regenerate. Restart the Event Log service after:

Restart-Service EventLog -Force

Step 4: Check disk health

Once the immediate error is gone, check the physical disk. Run this in PowerShell as admin:

Get-PhysicalDisk | Select-Object FriendlyName, MediaType, HealthStatus, OperationalStatus

If any disk shows Warning or Unhealthy, replace it. Even if it says Healthy, run a surface scan with chkdsk /r on all volumes. I've seen drives pass SMART checks but still have corrupted blocks that cause the exact 0x19CB error weeks later.

What if it still happens?

If the error returns after chkdsk and Event Log clearing, something deeper is wrong. Check these three things:

• Storage drivers — Update your RAID or SCSI controller driver. A buggy driver can corrupt disk writes just as surely as a failing disk.
• Write-cache settings — On the disk properties in Device Manager, disable Enable write caching on the device for the affected drive. This slows writes but forces every block to be written immediately. If the error stops, the cache is the problem.
• VM storage stack — If this is a virtual machine on Hyper-V or VMware, check that the host's storage isn't overcommitted. A host that queues too many disk writes can cause partial log blocks in the guest.

The 0X000019CB error is rarely a Windows bug. It's the canary in the coal mine for a storage problem. Fix the storage, and the canary stops chirping.