Fix ERROR_LOG_NO_RESTART (0X000019D3) on Windows Server

The 30-Second Fix: Reboot and Check for a Pending Restart

Before you dig into anything complicated, try a clean reboot. What's actually happening here is that the Windows Event Log service can't find the restart area in the log stream — basically, the pointer that says "start reading here" is missing or corrupted. A full restart often clears transient state that's holding the log file open.

1. Open Command Prompt as Administrator.
2. Run: shutdown /r /t 0
3. After the server comes back, check if the error still appears in the event viewer.

If the error goes away, you're done. But if it comes back after a few hours or days, the corruption is deeper — the log file itself is hosed. Move to the next step.

The 5-Minute Fix: Clear or Archive the Corrupt Log

Here's where we get specific. The problem is almost always the System log or Application log on servers that have run for months without log rotation. The log stream has a header that points to the restart area (the last known good write position). When that header gets corrupted — often from a sudden power loss or disk I/O error — the service can't start.

The real fix is to clear the log that's stuck. We'll use wevtutil because it's built-in and doesn't require a third-party tool.

1. Open PowerShell as Administrator.
2. Check which log is causing the issue. Run: wevtutil gl System — look for logFileName path. Usually it's %SystemRoot%\System32\winevt\Logs\System.evtx
3. Stop the Event Log service: Stop-Service EventLog
4. Rename the log file (don't delete it yet — you might want it for forensics):
   Rename-Item "C:\Windows\System32\winevt\Logs\System.evtx" "System.evtx.bak"
5. Start the service: Start-Service EventLog
6. A fresh System.evtx will be created automatically. Check if the error is gone.

If the error was in the Application log, swap System for Application in those commands. The reason step 3 works is that renaming the file lets the service create a new, clean stream. The old corrupted stream sits there as a backup.

But sometimes the error persists because the corruption is at a lower level — the NTFS file system itself has bad sectors where the log file lives. That's when you need the heavy artillery.

The 15-Minute Fix: Disk Check and Registry Cleanup

If clearing the log file didn't work, the issue is likely a filesystem problem. On busy servers — especially those running SQL Server or Exchange — constant writes to the event log can create disk errors that corrupt the file system metadata. The error 0X000019D3 can also hide in the registry if the service configuration is pointing to a non-existent log file.

Step 1: Run chkdsk with Repair

1. Open Command Prompt as Administrator.
2. Run: chkdsk C: /f /r — the /f flag fixes file system errors, /r locates bad sectors and recovers readable data.
3. You'll be asked to schedule it on next reboot. Type Y and restart.
4. The server will boot into a disk check before Windows loads. This can take 10-20 minutes depending on disk size and health.

After chkdsk finishes, the system will boot normally. If the log service still throws the error, move to the registry check.

Step 2: Verify the Log File Path in Registry

The Event Log service's log file paths are stored here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\File

Or for the Application log:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\File

1. Open Regedit as Administrator.
2. Navigate to the key for the log that's failing.
3. The default value should be: %SystemRoot%\System32\winevt\Logs\System.evtx
4. If it's pointing to a missing file or a different path, correct it.
5. If the registry key itself is missing (rare but happens after a botched restore), create it manually as a REG_EXPAND_SZ value.

The reason the registry path matters is that the service reads this key at startup. If it's empty or gone, the service doesn't know where to create the restart area and throws 0X000019D3 immediately.

Step 3: Rebuild the Log Manually (Last Resort)

If nothing else works, the corruption might have spread to the Event Log service DLLs. The nuclear option is to rebuild the log store entirely:

1. Stop the Event Log service again.
2. Delete all .evtx files in C:\Windows\System32\winevt\Logs (after backing them up).
3. Delete the registry keys under EventLog\System and EventLog\Application (yes, delete them — Windows will recreate them with defaults on next boot).
4. Restart the server.

This works because Windows detects missing log files and reinitializes the Event Log service from scratch, writing a fresh restart area. You'll lose historical logs, but the server will be functional again.

One last thing: After fixing this, set a log size limit to prevent it from happening again. In Event Viewer, right-click the log → Properties → set maximum log size to 20 MB (or whatever fits your retention policy) and enable "Overwrite events as needed." A log that never rolls over is a log that will eventually corrupt.