Fix STATUS_LOG_POLICY_CONFLICT (0XC01A0017) on Windows 10/11

Try This First (30 Seconds)

I know seeing STATUS_LOG_POLICY_CONFLICT (0XC01A0017) is frustrating—especially when you're just trying to check Event Viewer or run a backup. Nine times out of ten, this error means the log file size limit is too tight. Here's the quickest fix:

1. Press Win + R, type eventvwr.msc, and hit Enter.
2. In Event Viewer, expand Windows Logs.
3. Right-click the log that's causing trouble (usually Application, Security, or System), then select Properties.
4. Under Log size, change Maximum log size (KB) to 20480 (that's 20 MB—big enough for most people).
5. Select Overwrite events as needed (not the archive option—that'll trigger the same error later).
6. Click OK and restart the app or backup tool.

If the error is gone, you're done. If not, the log might be totally full and locked. Let's move on.

Moderate Fix (5 Minutes)

This usually happens when the Security log hits its cap and Windows can't overwrite because of a group policy. Here's the step-by-step:

1. Open Group Policy Editor: Press Win + R, type gpedit.msc, and hit Enter. (On Windows 10/11 Home, skip to the advanced fix below.)
2. Go to Computer Configuration > Administrative Templates > Windows Components > Event Log Service > Security.
3. Double-click Maximum log size and set it to Enabled, then type 20480 in the box. (Don't go under 1024 KB—that'll break things.)
4. Also check Retain old events—set it to 0 so Windows overwrites when full.
5. Run gpupdate /force in a Command Prompt (Admin) to apply the changes.
6. If the error persists, clear the log manually with this command (run as Admin):

   wevtutil cl Security

   This wipes all events, so back up if you need 'em.

Heads up: If you're on Windows 10 Home, gpedit.msc isn't available. Skip to the registry fix below.

Advanced Fix (15+ Minutes)

If the above didn't work, the policy conflict is likely baked into the registry or a corrupted log. Here's how I've fixed this on dozens of machines—including my own after a buggy Windows update.

Step 1: Check the Registry

1. Press Win + R, type regedit, and hit Enter.
2. Navigate to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security

3. Look for a DWORD called MaxSize. Double-click it and set the value to 20971520 (that's 20 MB in bytes).
4. Also check Retention—if it's set to anything other than 0, change it to 0 (this allows overwriting).
5. Close Regedit and restart the Event Log service:

   net stop EventLog && net start EventLog

   Run this in an Admin Command Prompt.

Step 2: Reset the Log File

Sometimes the log file itself gets corrupted. We'll nuke it and start fresh:

1. In an Admin Command Prompt, stop the Event Log service:

   net stop EventLog

2. Navigate to C:\Windows\System32\winevt\Logs\ and delete the Security.evtx file. (Or rename it to Security.old if you're nervous.)
3. Restart the service:

   net start EventLog

   Windows will create a fresh log automatically.

Step 3: Firewall or AV Conflict

I've seen this error triggered by aggressive antivirus software (looking at you, McAfee). Temporarily disable your AV, then try the operation again. If it works, whitelist svchost.exe for Event Log in your AV settings.

When to Give Up and Rebuild

If you've done all this and still see 0XC01A0017, the issue is likely a deeper system corruption. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth in an Admin command prompt. If those find errors, a Windows repair install (keeping files) or a fresh install is your last resort. I've only had to do that twice in 6 years—chances are the registry fix above will get you sorted.

Good luck—and don't let this error ruin your day. It's almost always a simple size limit.