Fix NS_I_START_DISK 0X400D005A Error

This error just means a NetShow admin started a disk — it's informational, not a real failure. Here's how to suppress it if it's spamming your logs.

The 30-Second Fix: Check If It's Really a Problem

First thing — this error code is informational. Microsoft defines it as a success message: 'A NetShow administrator started disk X.' It shows up in Event Viewer when someone manually starts a disk or stream in Windows Media Services (WMS).

Here's the trigger: You see this in the Application log after a junior admin clicks 'Start Disk' in the WMS console, or after a scheduled restart of the streaming service. It's not a crash, not a failure, not a warning. It's literally saying 'hey, I did what you asked.'

So step one: Don't panic. Open Event Viewer, look at the event details. If it says 'information' level and the description matches the disk start, you're done. No action needed. Move on.

The 5-Minute Fix: Stop the Log Spam

If this event is flooding your logs — I've seen it happen on busy servers with 50+ disks — you can filter it out. The culprit here is almost always the Windows Media Services role. You've got two options:

Disable the event source. Go to Services.msc, find 'Windows Media Services', right-click, Properties, set Startup Type to 'Disabled'. This kills all WMS events. Only do this if you're not using WMS for anything else.
Change the event log size or retention. Right-click 'Application' in Event Viewer, Properties, set max log size higher (like 20 MB) and choose 'Overwrite events as needed'. This buries the info events under more important stuff.

I prefer option 1 if WMS isn't in use. Most enterprises migrated away from NetShow years ago. If you still rely on it for streaming, go with option 2 instead.

The Advanced Fix (15+ Minutes): Registry Filtering or WMI Suppression

If you need to keep WMS running but can't stand the noise, you can suppress the specific event ID using a registry filter. This is a bit hacky but works on Windows Server 2008 R2 through 2019.

Step 1: Create a custom event filter

Open PowerShell as admin. Run this command to create a custom XML filter that drops event ID 0X400D005A (decimal: 1073741914):

wevtutil set-log Application /enabled:true /retention:false /maxsize:20971520 /level:0 /channel:Application /quiet:true /security:false

That won't do it alone. You need a subscription or a scheduled task to delete the event. Honestly, it's overkill. Instead, use this registry key to disable the WMS event provider entirely:

Step 2: Disable the provider via registry

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\EventLog\Microsoft-Windows-WMS" /v Enabled /t REG_DWORD /d 0 /f

Restart the server or reboot. That provider will stop writing any events, including NS_I_START_DISK. Warning: This also kills all WMS-related events — errors, warnings, everything. Use it only if you're certain WMS is stable and you don't need the logs for auditing.

Step 3: Verify the fix

After the reboot, manually trigger a disk start in WMS. Check Event Viewer. The event should be gone. If it's still there, double-check the reg key path. I've seen typos where people miss 'Microsoft-Windows-WMS' — it's case-sensitive.

Bottom line: For 99% of cases, the 30-second fix is all you need. The other two are for when you're OCD about clean logs. Don't over-engineer an info event.