Fix ERROR_LOG_CLIENT_ALREADY_REGISTERED (0x000019EC)

Cause 1: Two services fighting over the same log stream

I've seen this most often when a security tool or monitoring app tries to register its own log client, but the Windows Event Log service already has one registered for that stream. The error code 0x000019EC literally means "a log client has already registered on the stream."

You'll usually see this when you're running something like Sysmon, a third-party antivirus, or a custom logging tool and the built-in Event Log service is trying to do the same thing. The real fix is simple: stop the duplicate service.

1. Press Win + R, type services.msc, and hit Enter.
2. Look for services named things like Windows Event Log (it's the base one), Sysmon, or any tool that collects logs.
3. If you see two services that both log to the same place—say, Sysmon and a separate logging agent—stop the one that isn't essential. Right-click it, choose Stop, then set its startup type to Disabled.
4. Reboot your machine.

If the error was caused by a tool like Sysmon, you might need to reconfigure it to use a different log stream. But honestly, most people just need to disable the extra service.

Cause 2: A stale registration in the registry

Sometimes a service crashes or gets uninstalled badly, leaving a phantom log client entry in the registry. The next time Windows tries to start the Event Log service, it finds that leftover registration and throws the 0x000019EC error. This tripped me up the first time too, because the service isn't actually running—it's just a dead entry.

Here's how to clean it out:

1. Open Regedit as admin. Type regedit in the Start menu, right-click it, and pick Run as administrator.
2. Go to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Parameters

3. Look for any subkey named like LogClients or similar. Click on it and check the right pane for values that reference a specific client ID.
4. Back up your registry first: right-click the Parameters key and choose Export.
5. Delete any value that looks stale. I usually look for entries with names like Client1, Client2, etc. If you're not sure, compare timestamps of when the error started vs. when the entry was last modified.
6. Close Regedit and restart the Event Log service:

   net stop eventlog && net start eventlog

   (run this in an admin Command Prompt).

If the error goes away after that, you've nailed it. If not, undo the change by importing your backup—you might have deleted something important.

Cause 3: Corrupted event log files

This one's less common but definitely possible. The log stream itself can get corrupted, making Windows think a client is already registered when it isn't. I've seen this on Windows Server 2019 after a sudden power loss.

The fix is to clear the affected log. But don't do this unless you're prepared to lose that log's history.

1. Open Event Viewer as admin (right-click Start, choose Event Viewer).
2. In the left pane, expand Windows Logs, then click the log that's causing trouble. It's probably System or Security.
3. Right-click the log name and pick Clear Log....
4. Choose Save and Clear if you want a backup, or just Clear to toss it.
5. Alternatively, you can do this from the command line:

   wevtutil cl System

   (replace System with the actual log name). Run as admin.

After clearing, restart the Event Log service again. The error should vanish.

Quick-reference summary table

Start with Cause 1—it's the most common. If that doesn't work, move to Cause 2. And only use Cause 3 if you're desperate or the error started right after a crash.