#1 Most Common Cause: Backup Software or Disk Utility Trying to Write Directly
When I first saw this error, it was on a client's Windows Server 2016 machine running a nightly backup job with an older version of Symantec Backup Exec. The backup agent was trying to bypass the normal file system API and write directly to the physical log of the NTFS volume. Windows said, “No way” and threw STATUS_LOG_MULTIPLEXED (0xC01A001E).
The fix is simple: close the backup app, or disable its raw disk access feature. For Backup Exec, go to the job properties and turn off “Allow raw disk access”. For Veeam, make sure you're using the VSS (Volume Shadow Copy) integration, not direct pass-through. If you're using a forensic tool like FTK Imager that opens raw volumes, just close it—it's not meant for normal operation.
Here's how to tell if that's your problem:
- Open Event Viewer (eventvwr.msc).
- Look for a warning or error with source “Ntfs” and event ID 55 or similar.
- Check if the timestamp matches when your backup or scan runs.
If it matches, you've found the culprit. Stop the service, rerun the job with proper VSS integration, and the error disappears.
#2 Second Most Common Cause: Corrupted Log File or Disk Errors
Sometimes the error shows up not from a program but because the NTFS log itself is in a weird state. I've seen this after a sudden power loss on a file server. The $LogFile gets tripped up and starts reporting that it's multiplexed when it isn't. The system won't allow direct writes because it thinks the log is already split into multiple streams.
To fix this, you need to verify the disk first. Run chkdsk, but not the quick version. I know it takes time, but this is one of those cases where you don't cut corners:
chkdsk D: /f /r
Replace D: with the drive letter that's giving the error. You'll need to schedule it if the drive is in use, and then reboot. Chkdsk will rebuild the log file (the $LogFile attribute) if it finds corruption. I've also had luck with the /x parameter to force the volume to dismount first:
chkdsk D: /f /r /x
If chkdsk finds nothing, your next move is to check if the drive is dying. Run a SMART check with CrystalDiskInfo or the vendor's tool. Had a client whose RAID array was silently degrading, and this error was one of the first symptoms. Replaced the failing drive, and the error never came back.
#3 Third Most Common Cause: System Volume Shadow Copy or VSS Service Malfunction
This one sneaks up on you. The Volume Shadow Copy service (VSS) is what lets Windows create restore points and backups. If that service is stopped or corrupted, certain operations try to write directly to the log, and boom—you get 0xC01A001E.
I ran into this on a Windows 10 machine that had a third-party antivirus that disabled VSS to “protect” it. The user saw the error when trying to use System Restore.
Fix it by restarting the service and making sure it's set to automatic:
- Press Win + R, type
services.msc, and hit Enter. - Find “Volume Shadow Copy”.
- Set Startup Type to “Automatic”.
- If it's not running, right-click and choose “Start”.
Also check the dependent services: “Microsoft Software Shadow Copy Provider” and “COM+ Event System”. They should all be running. If any of them won't start, you might need to re-register the VSS DLLs from an elevated command prompt:
cd /d %windir%\system32
net stop vss
net stop swprv
regsvr32 /s ole32.dll
regsvr32 /s oleaut32.dll
regsvr32 /s vss_ps.dll
vssvc /Register
net start vss
net start swprv
That's the heavy hammer. Try the service restart first, and only go to the DLL re-registration if the error persists.
Quick-Reference Summary Table
| Cause | Symptom | Fix |
|---|---|---|
| Backup/forensic tool writing directly | Error appears during backup or raw disk access | Disable raw access or close the app; use VSS integration |
| Corrupted NTFS log file | Error after power loss or sudden shutdown | Run chkdsk /f /r /x |
| VSS service stopped or corrupted | Error during System Restore or backup | Restart VSS service, set to Automatic, re-register DLLs |
If you've tried all three and still see 0xC01A001E, you might be dealing with a low-level filter driver or a third-party disk utility that's hooking into the file system. Boot into Safe Mode and see if the error disappears. If it does, you know it's a driver or service. Then use msconfig to disable startup items one by one until you find the troublemaker.