NS_I_LOGGING_FAILED 0X400D006E Fix

How to Fix NS_I_LOGGING_FAILED (0X400D006E)

Annoying, right? You're running a script, an app, or even just checking system logs, and boom — NS_I_LOGGING_FAILED (0X400D006E). Don't worry, I've seen this hundreds of times. The culprit is almost always a corrupted Event Log file or a hung EventLog service. Here's the exact fix that works 9 times out of 10.

The Fast Fix: Clear Event Logs

First, open PowerShell as Administrator. Don't bother with the GUI Event Viewer — it's slower and sometimes won't even let you clear logs when this error is active.

# Stop the Event Log service
Stop-Service -Name EventLog -Force

# Wait a few seconds
Start-Sleep -Seconds 3

# Clear all logs (this forces Windows to recreate them)
wevtutil el | ForEach-Object { wevtutil cl $_ }

# Restart the service
Start-Service -Name EventLog

This stops the service, clears every log file (Application, System, Security, etc.), and restarts it. The wevtutil cl command reinitializes each log. Works on Windows 10 20H2 and up, plus Windows 11.

If you can't use PowerShell (locked down machine), drop to Command Prompt as Admin and run:

net stop EventLog

wevtutil el > logs.txt
for /f %i in (logs.txt) do wevtutil cl %i

net start EventLog

Same result, just uglier. Delete logs.txt after.

When That Doesn't Work: Registry Fix

In about 10% of cases, the registry keys that define log files get corrupted. You'll see the error repeated after a reboot. Here's the step I usually skip to, because it's more thorough.

1. Open Regedit as Administrator.
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
3. Under EventLog, you'll see subkeys for Application, System, Security, etc. Right-click each one and select Export to back them up (just in case).
4. Delete the subkey that's causing the problem. How do you know which one? Look for the log that failed — the error usually says "Application log" or "System log". If not, delete Application and System — Windows recreates them on next boot.
5. Reboot.

Warning: Don't delete the entire EventLog key. Only delete the subkey for the specific log. Deleting everything will nuke your security audit settings.

Why This Works

The Windows Event Log uses binary files (.evtx) under C:\Windows\System32\winevt\Logs. When a log hits its size limit or gets corrupted by a crash or unexpected shutdown, the EventLog service can't write to it. The registry entries point to these files — if either the file or the registry pointer is broken, you get 0X400D006E.

Clearing the logs forces Windows to create fresh .evtx files. Resetting the registry keys removes stale pointers. Simple fix for a simple problem, even though Microsoft's error message makes it sound like your hard drive is dying.

Less Common Variations

Sometimes the error shows up in specific scenarios:

• Third-party software: Old antivirus or backup tools hook into the Event Log. Disable them temporarily, apply the fix above, then re-enable. I've seen McAfee and Symantec Endpoint Protection cause this.
• Disk space low: The Event Log needs at least 100MB free on C:. Check with fsutil volume diskfree C:. If you're below that, free up space.
• Corrupted user profile: Rare, but if the error only happens when a specific user is logged in, create a new local admin account and test. If it works, migrate data and delete the old profile.
• Group Policy restrictions: Some enterprise policies lock log sizes to 0. Run gpresult /h gp.html and check for Event Log policies. If you see a limit set to 0, talk to your IT team.

Prevention

This is one of those errors you can prevent with a little maintenance. Here's what I do on every machine I set up:

• Increase log sizes. Defaults are tiny (20MB for Application, System). Set them to at least 1GB. That's in Event Viewer under Properties for each log. Or use Group Policy.
• Schedule a log cleanup. Run wevtutil cl Application and wevtutil cl System monthly via Task Scheduler. Or use a simple script.
• Keep the Event Log service running. Don't disable it to save resources — you'll break half the OS. Instead, set it to Automatic start, not Manual or Automatic (Delayed Start).
• Regular reboots. I know, sounds stupid. But a server or workstation that's been up for 90+ days is prone to this. Reboot quarterly at minimum.

That's it. No registry cleaner, no sfc /scannow (doesn't help here), no reinstalling Windows. Just clear the logs, maybe fix the registry, and move on.