Fix STATUS_LOG_INCONSISTENT_SECURITY (0XC01A002E) fast
This error means log security settings don't match its container. Usually a permissions mismatch. Here's how to fix it.
You're seeing this error and it's frustrating
I know. STATUS_LOG_INCONSISTENT_SECURITY stops your system from writing to a log file. It's not a common error, but it's a real pain. Good news: the fix is usually simple. Bad news: you gotta do it by hand.
What causes this?
This error appears when the security settings (permissions, owner, ACLs) on a log file don't match the security settings on the folder that holds the log. Windows checks this automatically. If they don't line up, you get 0XC01A002E.
You'll most often see this on Windows Server 2016, 2019, or 2022 when you're dealing with system logs like the Application or System event log. But it can happen with any log file – SQL Server logs, IIS logs, even custom app logs.
The fix: reset permissions
Step 1 – Find the log file and folder
First, you need to know which log is broken. Look in your Event Viewer for warnings, or check the application that's crashing. The error message usually mentions a path. Write it down.
Example: C:\Windows\System32\winevt\Logs\Application.evtx
Step 2 – Take ownership
Open Command Prompt as Administrator. Not PowerShell – plain CMD works better for this.
takeown /f "C:\Windows\System32\winevt\Logs\Application.evtx"
After you run that, you should see: "SUCCESS: The file (or folder) ... now owned by Administrators."
Step 3 – Grant full control to SYSTEM
icacls "C:\Windows\System32\winevt\Logs\Application.evtx" /grant "SYSTEM:(F)"
You'll see: "processed file: ... Successfully processed 1 files."
Step 4 – Do the same for the folder
takeown /f "C:\Windows\System32\winevt\Logs"
icacls "C:\Windows\System32\winevt\Logs" /grant "SYSTEM:(F)"
Again, check for success messages.
Step 5 – Restart the Windows Event Log service
Open Services.msc, find "Windows Event Log", right-click, select Restart. Or use CMD:
net stop EventLog && net start EventLog
The system will tell you it's starting and stopping. Wait 10 seconds after the restart, then test your application.
Why this works
The error comes from a security descriptor mismatch. Windows compares the security descriptor on the file to the one on its container. If they're different – even by a single bit – it throws 0XC01A002E. By resetting both to the same owner and permissions, you eliminate the mismatch. The SYSTEM account is the safest choice because it's consistent across all Windows installs.
Less common variations
Different log file
If you're working with a custom app log, the fix is identical but the path changes. For example, C:\MyApp\Logs\app.log. Same commands, just replace the path.
Third-party backup software interfering
I've seen Veeam or Acronis backup jobs cause this. They sometimes mess with NTFS permissions during a restore. If you see this after a restore, check the backup log and re-run the permission fix.
Corrupted security descriptor
Rare, but happens. Use PowerShell to check the security descriptor:
(Get-Acl -Path "C:\Windows\System32\winevt\Logs\Application.evtx").GetSecurityDescriptorSddlForm()
If it looks garbled or empty, your ACL is corrupted. In that case, rename the log file (e.g., to Application.old) and let Windows create a fresh one. The error will go away.
Prevention
Don't manually edit permissions on log files or folders. Let Windows handle them. If you must change permissions, use the same account (SYSTEM) for both file and folder. Also, avoid moving log files between folders – that's a common trigger. If you use backup software, verify it restores permissions correctly.
One more thing: keep your Windows updated. Microsoft patched a few permission-related bugs in recent cumulative updates. Check Update History if you're on an older build.
Was this solution helpful?