Fix EVENT_E_INTERNALERROR 0x80040206 on Windows

Cause #1: Corrupted Event Log files

I've seen this more times than I can count. The error 0x80040206 pops up when you open Event Viewer and try to view a log. It says "An unexpected internal error was detected." Nine times out of ten, it's because the actual .evtx files on disk are corrupted or have gotten stuck in a bad state.

Last month, a client's Windows 11 machine threw this right after a forced shutdown. The security log file had a write error, and Event Viewer couldn't read it. Here's the fix that works 90% of the time.

Step 1: Stop the Event Log service

net stop eventlog

Run that in an admin Command Prompt. The service will stop—if it doesn't, you might have a stuck process. A reboot usually handles that, but try the next step anyway.

Step 2: Rename the corrupted log files

Go to C:\Windows\System32\winevt\Logs. You'll see a bunch of .evtx files. The most common culprit is Security.evtx, but it could be System.evtx or Application.evtx. Rename them to something like Security.bak (don't delete—keep backups). Windows will recreate fresh ones when you restart the service.

Step 3: Start the service and test

net start eventlog

Open Event Viewer. If the error's gone, you're done. If not, move to the next cause.

Cause #2: The Event Log service is hung or permissions are off

Sometimes the service itself is running but stuck. I've seen this after a Windows Update that bungled the service startup. Or a third-party security tool—like an old antivirus—locked the event log files. Real story: a small law office's machine had this error because their backup software held a file handle on the Application.evtx file. The fix?

Reset service permissions

Open an admin Command Prompt and run:

wevtutil gl security

That shows the current config. If it errors out, the service might not have proper access. Reset it:

wevtutil cl security

That clears the log (not the file—just the internal state). Then restart Event Viewer. If that fails, run a system file check:

sfc /scannow

Wait for it to finish. Reboot. If the problem's still there, it's not file corruption—something else is blocking the service.

Cause #3: Third-party software interference

This is the sneaky one. Some apps hook into the Event Log service to monitor things—like security software, performance monitors, or even old printer drivers. I had a client whose ancient HP printer driver caused this error every time they printed a PDF. The driver's event hook was incompatible with Windows 10 22H2. Uninstalling the printer driver fixed it.

How to find the culprit

Boot into Safe Mode with Networking. If the error disappears, a third-party app is to blame. Do a clean boot:

Type msconfig in the Start menu.
Go to Services tab, check "Hide all Microsoft services", then click "Disable all".
Go to Startup tab, open Task Manager, disable all startup items.
Reboot. If the error's gone, enable services one by one until it returns.

Common suspects: antivirus (especially McAfee or Norton), backup software, and anything that logs system events. Uninstall the troublemaker, not just disable it.

Quick-reference summary table

Cause	Symptom	Fix
Corrupted .evtx files	Error when viewing specific log (e.g., Security)	Stop eventlog service, rename .evtx files, restart service
Service hung or permissions wrong	Error on any log, or service won't start	Run wevtutil cl [logname], then sfc /scannow
Third-party software blocking	Error only happens with certain apps running	Clean boot to identify, then uninstall the app

Start with Cause #1—it's the most common and the quickest fix. If that doesn't work, work your way down. I've never seen a case where all three failed, but if they do, a repair install of Windows (using the Media Creation Tool) will nuke the problem. That's the nuclear option, though—try the steps above first.