Fix ERROR_LOG_INVALID_RANGE 0X000019CC on Windows Server

When This Error Pops Up

You're probably seeing 0X000019CC right after a server reboot—maybe after a power failure or a forced shutdown because the C: drive filled up. Or perhaps you opened Event Viewer and got a blank window with this error in the Application or System log. It's also common on Windows Server 2019 and 2022 when the .evtx files get truncated or corrupted. I've dealt with this on a dozen servers, and it's always the same story: the log service can't find where the valid entries start or end.

What's Actually Happening

The Event Log service keeps track of the active range—think of it as a pointer to the first and last valid log entry. When the log file gets damaged (partial write during a crash, or a disk I/O error), that pointer goes haywire. The service then throws ERROR_LOG_INVALID_RANGE because it's trying to read or write at an offset that doesn't exist in the file. It's not a hardware failure—it's a metadata corruption in the .evtx file itself.

How to Fix It

Skip the registry edits or SFC scans—they won't touch the evtx files. The real fix is to clear the corrupted logs. But don't just delete them. You need to stop the service first, or Windows will lock the files and you'll get access denied.

Open an elevated Command Prompt or PowerShell — right-click Start, choose Windows Terminal (Admin) or Command Prompt (Admin).
Stop the Event Log service with:
```
net stop EventLog /y
```
This also stops dependent services like Windows Time. That's fine.
Find the corrupted log files. They live in %SystemRoot%\System32\winevt\Logs. Run:
```
dir %SystemRoot%\System32\winevt\Logs
```
Look for files with last-modified timestamps matching the crash time. Common culprits: Application.evtx, System.evtx, Security.evtx.
Rename the problematic files (don't delete yet—just in case):
```
ren %SystemRoot%\System32\winevt\Logs\Application.evtx Application.old
```
If you're not sure which log is corrupt, rename all of them. Yes, all. Windows will recreate fresh ones.
Restart the Event Log service:
```
net start EventLog
```
Verify — open Event Viewer. You'll see clean logs. The error should be gone.

If It Still Fails

Two things I check next. First, disk space: if your C: drive is below 100 MB, the service can't write new logs. Free up space or extend the volume. Second, permissions: the Logs folder must have SYSTEM and Administrators with Full Control. Use icacls to reset:

icacls %SystemRoot%\System32\winevt\Logs /reset /t

If you're still seeing the error after that, run wevtutil el to list all logs, then wevtutil cl <logname> for each one after renaming them back. I've never seen it survive those steps.

One last tip: if you renamed all logs, you'll lose history. That's fine for most servers—old log entries aren't worth the headache. If you need the old data, restore from backup before renaming.