Fix STATUS_LOG_NO_RESTART (0X401A000C) on Windows Server

Quick answer

Delete and recreate the USN journal on the affected volume using fsutil usn deletejournal /d C: (replace C: with your drive), then reboot. That's it.

Why this happens

This error isn't some random glitch — it's the log service hitting a corrupt or missing restart area in a log stream. In practice, I've seen it most often after a hard crash or failed disk write that corrupted the NTFS USN (Update Sequence Number) journal. The system tries to read the journal's restart area during boot or volume mount, can't find a valid entry, and throws 0X401A000C. You'll see it in Event Viewer under System logs, often paired with Event ID 50 or a disk error. The culprit is almost always a corrupt USN journal, not a bad driver or a permissions issue. Don't bother with SFC or DISM first — they won't touch the journal.

Fix steps

1. Identify which volume — Check Event Viewer for the drive letter or volume GUID mentioned in the error. If it's vague, run fsutil usn queryjournal C: (try C:, D:, etc.) and look for the volume that fails.
2. Open an elevated command prompt — Right-click Command Prompt, run as Administrator.
3. Disable any backup software — If you've got VSS-aware backup tools running (like Veeam, BackupExec), pause them. They can interfere with the journal delete.
4. Delete the USN journal — Run fsutil usn deletejournal /d C:. Replace C: with the actual drive. The /d flag deletes and disables the journal. This takes a few seconds.
5. Recreate the journal — Run fsutil usn createjournal m=16777216 a=1 C:. The m value sets max size (16 MB default), a is allocation delta. This recreates a clean journal.
6. Reboot — A restart is mandatory to reinitialize the log service.

If the main fix fails

Sometimes the journal won't delete because the volume is in use or locked. Here's what to try:

• Safe mode — Boot into Safe Mode with Networking (no third-party services loading), then retry the fsutil steps. Works 9 times out of 10.
• Offline with DiskPart — If Safe Mode fails, use diskpart, select the volume, then offline volume. Re-run the fsutil commands. Bring it back online with online volume.
• chkdsk /f — Only do this if the above fails. chkdsk C: /f can fix underlying filesystem corruption that prevents journal access. Schedule it for next reboot. Be warned — chkdsk alone rarely fixes the log error without the journal rebuild.

Prevention tip

This error is a symptom of filesystem corruption. To avoid it, keep your disks healthy. Monitor for SMART errors, replace failing drives promptly, and always use a UPS to prevent crashes during writes. Also, if you're running Hyper-V or heavy I/O workloads, consider increasing the USN journal size — m=268435456 (256 MB) gives more headroom. You can check current size with fsutil usn queryjournal C:.