Fix ERROR_LOG_READ_MODE_INVALID (0X000019D2) in Windows Server

1. Corrupt Event Log File – The Most Common Cause

Had a client last month whose event log service just died after a power surge. Their UPS didn't kick in fast enough. The system rebooted, and boom—0X000019D2 every time they opened Event Viewer.

This error means the log service tried to read a log file in a mode it doesn't support. Nine times out of ten, that's because the log file itself got nuked. Windows Event Log files (.evtx) are binary and fragile. A sudden crash, disk write error, or even a bad sector can corrupt them.

The Fix: Clear the Corrupt Log

Don't waste time trying to repair a corrupt .evtx file. That's a rabbit hole. Just delete the log that's causing grief. Here's how:

1. Open Event Viewer (press Win + R, type eventvwr.msc, hit Enter).
2. Expand Windows Logs and right-click the log that's failing (probably System or Application).
3. Select Clear Log.
4. Click Save and Clear if you want to keep the history, or Clear to just wipe it.
5. Restart the Windows Event Log service: open Command Prompt as admin and run net stop EventLog && net start EventLog.

If clearing through Event Viewer doesn't work (it stalls or errors out), go nuclear: stop the service, delete the file manually. The logs live at C:\Windows\System32\winevt\Logs. For example, System.evtx for the System log. Stop the service, delete that file, start the service back up. Windows recreates it automatically. I've done this on Server 2016 and 2019—works every time.

2. Corrupted Event Log Service State

Sometimes the log files are fine, but the Event Log service itself has a corrupted internal state. This happens when the service crashes mid-write or gets interrupted by a forced reboot. I saw this on a Server 2012 R2 box that had a disk I/O bottleneck—the log service just couldn't flush properly.

The Fix: Reset the Service Configuration

Step 1: Stop the Event Log service again.
net stop EventLog

Step 2: Rename the log directory to force a fresh start. Don't delete it—just rename it so you can revert if needed.
ren C:\Windows\System32\winevt\Logs Logs.old

Step 3: Restart the service.
net start EventLog

Windows will create a fresh Logs directory and empty log files. If you need the old logs, grab them from Logs.old later. But honestly, if the service state was corrupted, those old logs are suspect anyway.

3. Permissions Locking the Log File

Less common, but I've seen it. A security policy change or a script that tweaked ACLs on C:\Windows\System32\winevt\Logs can break access for the Event Log service account (NT SERVICE\EventLog). That triggers error 0X000019D2 because the service can't open the file in the right mode.

The Fix: Verify and Repair Permissions

1. Open an admin Command Prompt.
2. Run icacls C:\Windows\System32\winevt\Logs to check current permissions.
3. You need at least NT SERVICE\EventLog with Read and Write access. If missing, run:
   icacls C:\Windows\System32\winevt\Logs /grant "NT SERVICE\EventLog":(OI)(CI)(RX,W)
4. Restart the Event Log service.

If you're on a domain-joined server, check if a Group Policy is overwriting these permissions. That's a pain—you'll need to work with your domain admin to exclude this path from the policy.

Quick-Reference Summary

Try the first fix. It's the one that works 80% of the time. If not, move down the list. Don't waste hours on this—I've been there. Just nuke the log and move on.