Fix ERROR_LOG_DEDICATED 0x19E7 (Dedicated Log)

Yeah, that error is a pain. You're staring at 0X000019E7 and wondering why a log file won't just behave. I've seen this on Windows Server 2016 and 2019, and it's almost always a handle problem. Let's get it fixed.

The Fast Fix: Restart the Service

The quickest way out is to bounce the service that owns the log. In my experience, 9 times out of 10 that's the Event Log service or a custom app like SQL Server or Exchange. Here's what I do:

Open an elevated Command Prompt (right-click, Run as administrator).
Type services.msc and hit Enter.
Find the service that's throwing the error—look at the application name in the event source.
Right-click it and select Restart.

If it's the Event Log service itself, that's trickier because you can't just stop it from the GUI. Use this instead:

net stop eventlog && net start eventlog

That usually kicks the locks free. But if the error persists, you've got a hung handle that needs a different approach.

Why This Works

Here's the deal: ERROR_LOG_DEDICATED means the log file is created with a dedicated handle—one writer, no sharing. When your code tries to open it again for reading or writing, the OS says "nope, that log's taken." Restarting the service clears all handles because the process dies and the log gets released. It's not elegant, but it works.

Keep in mind, this error isn't new. It's been around since Windows 2000, and the logic hasn't changed. The kernel's log manager (part of the I/O subsystem) enforces that dedication. You can't override it with a flag or a registry tweak—that's the point.

Less Common Variations

Sometimes restarting isn't enough. Here's what I've run into on real systems:

1. The Log Is in a Corrupted State

If the log file is partially corrupted, the handle might be stuck even after a service restart. Check the file at its typical location—something like C:\Windows\System32\winevt\Logs\. You'll see a bunch of .evtx files. If one is 0 KB or has a weird timestamp, that's your culprit.

To fix it, rename the file (back it up first) and let the system recreate it:

ren C:\Windows\System32\winevt\Logs\Application.evtx Application.old

Then restart the Event Log service. Don't delete it outright—renaming is safer.

2. Your Code Is Reusing the Same Handle

If this is a custom app you're writing, the error means you're trying to open a log with CreateFile or OpenFile when you already have it open with a dedicated flag. The fix is to use a normal handle, not a dedicated one. In Win32, that flag is FILE_FLAG_BACKUP_SEMANTICS or something similar—but honestly, if you're not sure, just open it with GENERIC_READ and see if that clears it.

3. Multiple Services Fighting Over One Log

I saw this once on a SQL Server cluster. Two nodes were trying to write to the same error log. The dedicated log error was a symptom, not the cause. The real fix was to configure each node to use its own log file. Check your application's settings for log file paths—if they're pointing to a shared location, that's your problem.

Prevention: Stop It Before It Happens

You don't want to keep restarting services every week. Here's how I keep this from biting me:

Set proper log rotation. Make sure your apps and Windows are configured to roll logs by size, not just date. A log that never rolls is a log that stays open forever.
Handle errors in your code. If you're a dev, always close handles with CloseHandle() after you're done. Forgetting that is the number one cause of dedicated log locks.
Monitor for the error. Set up a simple alert in Event Viewer or your monitoring tool for event ID 0x19E7. Catch it early, and you'll bounce the service before users notice.

That's the whole playbook. Restart the service, check for corruption, and if it's your code, fix the handle usage. You'll be back up in minutes.