STATUS_INVALID_EA_NAME (0x80000013) Fix: Illegal EA Character

I know seeing STATUS_INVALID_EA_NAME (0x80000013) can be confusing. It's not a common error like a blue screen, so it feels mysterious. But the root cause is almost always one thing: a file or folder on your NTFS drive has an extended attribute (EA) with a character Windows considers illegal. This usually happens when a third-party tool writes an EA with a colon, bracket, or control character that NTFS's native API doesn't parse correctly.

Let me walk you through the three most likely causes, starting with the one that fixes 80% of cases in my experience.

Cause 1: A Corrupt or Invalid EA on a Specific File

This is the big one. The error almost always points to a single file whose EA name contains an illegal character—often a colon (:) or a null byte. These aren't allowed in regular filenames, but they can slip into EA names if you use tools like setxattr from Linux via WSL, or old backup software that writes EAs in a non-standard way.

Here's the fix that worked for me after hours of head-scratching:

1. Find the offending file using PowerShell. Run this from an elevated prompt (Admin):
   

   Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | ForEach-Object { try { $_.GetAccessControl() } catch { Write-Output $_.FullName } }

   This lists files that cause errors when you try to read their security info. Note the paths.
2. Check EA metadata with fsutil. For any suspicious file, run:
   

   fsutil file queryextendedattribute C:\path\to\file.txt 0x0000

   If the command says "Invalid EA name", you've found your culprit.
3. Strip the EA using PowerShell or a tool like Sysinternals Streams. The cleanest method:
   

   Remove-Item -Path "C:\path\to\file.txt" -Stream * 2>$null

   This deletes all alternate data streams (which include EAs). If the file is critical, back it up first.
4. Run chkdsk after the fix to verify the drive is clean:
   

   chkdsk C: /f /r

   You'll need to reboot for this to run.

One real-world case I handled: A user ran wsl --set-version Ubuntu 2 and it added an EA with a colon to a hidden file in %USERPROFILE%\AppData\Local\Packages. The error popped up every time they tried to open File Explorer in that directory. Removing the EA stopped it cold.

Cause 2: Third-Party Software Writing Bad EAs

Some backup tools, especially older ones from before Windows 10 (like Norton Ghost 15 or Acronis True Image 2018), write EAs with proprietary tags that include characters like [ or $. These work in their own environment but trip up Windows' native EA handler.

Quick fix: Check if the error only happens when a particular app is running. If yes, update that app or uninstall it. Then clean up its EA mess:

1. Use Process Monitor from Sysinternals to filter by STATUS_INVALID_EA_NAME. This tells you which file triggers the error and what process is doing it.
2. If it's a backup app, re-run its backup catalog rebuild function. That often overwrites the bad EAs.
3. For stubborn cases, delete the file and restore it from a clean backup (one that doesn't use EAs).

If you're using Windows 11 22H2 or later, there's a known issue with an EA named :$DATA created by some file syncing apps (Google Drive, Dropbox). That colon is the problem. Update those apps to the latest version—they've patched it.

Cause 3: NTFS Metadata Corruption on the Drive

Less common, but it happens: The NTFS $MFT (Master File Table) or the EA index itself gets corrupted. This can happen after an abrupt shutdown, a faulty disk, or a failed fsutil command.

How to check:

• Run chkdsk C: /f from an admin command prompt. If it finds errors in index entries or EA records, let it fix them. Reboot.
• If chkdsk can't fix it, use fsutil repair query C: to see if self-healing is active. Windows 10 and 11 have it on by default. If not, run fsutil repair initiate C: to trigger online repair.

I once saw this on a Surface Pro 7 that had been force-shutdown during a Windows update. The EA index had a corrupt entry that made every Get-ChildItem in one folder throw 0x80000013. Running chkdsk with the /b flag (re-evaluate bad clusters) fixed it.

If chkdsk reports unfixable corruption, back up your data immediately and replace the drive. That's rare, but it's a warning sign of hardware failure.

Quick-Reference Summary

Try cause 1 first. It's the most common and the easiest to test. If that doesn't work, move to cause 2, then 3. You'll be back to normal before you know it.