Status 0xC000018F: Event Log Can't Start on Server

Quick answer for advanced users

Stop the Event Log service, rename or delete the corrupted .evtx files in C:\Windows\System32\winevt\Logs, then restart the service. That's it.

Why you're seeing this error

Error 0xC000018F usually shows up after a server crash, a bad disk, or when you run out of disk space on the system drive. The event log service tries to open its log files and can't. Maybe a file is damaged, maybe the service doesn't have permission to write to the folder, or maybe the file is just too big. On Windows Server 2019 and 2022 I've seen this happen often after a power failure. The event logs get corrupted while the server is shutting down hard.

The real fix is to either repair the log files or replace them with fresh empty ones. You'll lose the old log entries, but you can't read them anyway if the service won't start.

Fix steps

Here's what to do, step by step.

1. Open Services. Press Win + R, type services.msc, press Enter.
2. Stop the Event Log service. Find Windows Event Log in the list. Right-click it and choose Stop. If it's already stopped, skip this step.
3. Open File Explorer. Go to C:\Windows\System32\winevt\Logs. This is where the .evtx files live.
4. Back up the logs. Select all the files in that folder (Ctrl+A), then copy them (Ctrl+C) and paste them into a new folder on your desktop called EventLogBackup. This is just in case you need them later for an audit.
5. Delete the corrupted files. Go back to the Logs folder. Delete everything inside it. Don't delete the folder itself, just the files inside it. Windows will ask for permission, click Yes.
6. Start the Event Log service. Go back to the Services window. Right-click Windows Event Log again and choose Start.
7. Check if it worked. Open Event Viewer (press Win + R, type eventvwr.msc). You should see the logs populating again. If you see any errors, let me know.

Alternative fix if the main one fails

If after deleting the files the service still can't start, the problem might be with the service itself or the registry. Here's what to try next.

Check the registry path. Open Registry Editor (press Win + R, type regedit). Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog. Look at the ImagePath value. It should say %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted. If it's missing or wrong, fix it. Then restart the service.

Reset the security on the folder. Right-click the C:\Windows\System32\winevt\Logs folder, choose Properties, go to the Security tab. Click Advanced. Make sure NT SERVICE\EventLog has Full Control. If it's missing, add it. Apply the changes, then try starting the service again.

Use the command line. Open Command Prompt as Administrator. Type wevtutil el and press Enter. This lists all event logs. If it returns an error, run wevtutil cl Application (replace Application with the log name that's broken). This clears the log file without deleting it. Do this for each log that's stuck. Then restart the service.

Prevention tip

To keep this from happening again, set a max size on your event logs. By default, Windows will let them grow huge. Right-click a log in Event Viewer (like Application), choose Properties, set a max log size like 20 MB. Also check the box for Overwrite events as needed. This way when the log fills up, Windows deletes old entries instead of breaking the whole file.

Also make sure your server has a UPS plugged in. A clean shutdown avoids log corruption. I know that sounds obvious, but I see servers without UPS all the time and it causes this exact problem.

If you're still stuck after all this, you might need to run an SFC scan (System File Checker). Open Command Prompt as Administrator, type sfc /scannow, let it finish. It will fix any system files that might be damaged, including the event log service files. Then try the steps again.