Fix STATUS_LOG_INVALID_RANGE (0XC01A0005) on Windows Server

Cause 1: Corrupted NTFS $LogFile (most common)

When the NTFS metadata log (that's the $LogFile) gets out of sync, any program trying to write or read beyond the log's current range will hit 0XC01A0005. You'll see this after a dirty shutdown, a power loss, or a failed disk write. The error often appears in applications like Exchange, SQL Server, or even backup tools.

The quickest fix is to run chkdsk. It rebuilds the log file structure. On a busy server you might want to schedule it during a maintenance window because it can take a while on large volumes.

1. Open an elevated Command Prompt (right-click Command Prompt and select Run as administrator).
2. Type the following and press Enter:
   

   chkdsk C: /f

   Replace C: with the drive where the error appears. If it's the system drive you'll be asked to schedule it for next reboot—type Y and reboot.
3. Wait for the scan to complete. If it finds errors, let it fix them. After the scan finishes, reboot the server if you scheduled it.
4. After the reboot, test the application that triggered the error. In most cases, the error is gone.

If chkdsk doesn't work (or you can't reboot right away), you can try a more targeted approach. Use fsutil to check the log file's state:

fsutil usn queryjournal C:

If that command fails with a similar error, the journal is definitely corrupted. You can delete and recreate it, but that's a last resort—do it only if chkdsk fails:

fsutil usn deletejournal /d C:

That wipes the USN journal, not the $LogFile itself, but sometimes it resets the log range. After running it, reboot and see if the error clears.

Cause 2: Application bug or driver conflict (second most common)

The error isn't always about the OS log. Some applications—especially older ones running on Server 2012 R2 or 2016—try to read a log file that's been truncated or rotated. I've seen this with certain antivirus drivers and backup agents. The app thinks the log has 10,000 entries but the file was replaced at 5,000.

Here's what to do:

1. Identify the process that's throwing the error. Open Event Viewer (eventvwr.msc) and look under Windows Logs > Application for the error event referencing 0xC01A0005. Note the source and the module name.
2. Check if that application has an update. Go to the vendor's website and look for patches. For example, if it's a VSS-related error, install the latest VSS update for your OS version.
3. If no update exists, try disabling any antivirus real-time scanning temporarily to see if the error stops. I've seen AV drivers cause this because they hook into the file system and mess with log reads.
4. Also, check if the error occurs only when the system is under heavy I/O. If so, update your storage drivers (SAS or NVMe) from the manufacturer's site, not just from Windows Update.

If updating doesn't help, use Process Monitor from Sysinternals to see which file is being accessed when the error triggers. Filter by the process name and look for attempts to read a log file with a path that seems odd (like a zero-byte file).

Cause 3: Registry setting or third-party filter driver (less common but real)

Sometimes the error is caused by a third-party filter driver (like a backup or encryption tool) that's holding onto an invalid log range. You can test this by rebooting into Clean Boot mode.

1. Press Win + R, type msconfig, and press Enter.
2. On the Services tab, check Hide all Microsoft services and click Disable all.
3. On the Startup tab, click Open Task Manager and disable all startup items.
4. Restart the server. If the error disappears, re-enable services one by one until it comes back—that's your culprit.

Another thing to check: a registry key that controls the log range for certain services. For example, if you're using a custom log location for a service like DNS or DHCP, make sure the path in the registry points to a valid file. Here's a typical key to inspect:

HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\Parameters\LogFilePath

Open Registry Editor (regedit.exe) and verify that path exists and isn't pointing to a deleted file. If it's missing, recreate the directory or correct the path. After making any change, restart the service.

Quick-Reference Summary Table

Most of the time, the first fix solves it. If you're still stuck after trying all three, backup your data and run sfc /scannow to check system file integrity. But honestly, I've seen this error maybe a dozen times in my career, and chkdsk fixed it every single time except when it was a rogue antivirus driver.