STATUS_LOG_PINNED (0XC01A002C) — Log Space Can't Be Reclaimed

1. Restart the Application or Service Holding the Pinned Log

This tripped me up the first time too. The STATUS_LOG_PINNED error tells you one thing: something has locked a log stream, preventing Windows from reclaiming space. In my years running a help desk blog, the most common culprit was a database or backup application that crashed mid-transaction, leaving its reservation active.

Think of it like a checkout lane at a store. If someone stops scanning items and walks away, the lane stays blocked. The log is that lane. Restarting the client that reserved it usually frees it up.

What to do:

1. Identify which process has the log open. Use Process Explorer or handle.exe from Sysinternals. Look for handles to files ending in .blf or .log inside the logs directory.
2. Once you spot the process (e.g., sqlservr.exe for SQL Server, ntds.exe for Active Directory, or a backup agent), restart that service gracefully. Run this in an elevated command prompt:
   

   net stop "ServiceName" && net start "ServiceName"

   Replace "ServiceName" with the actual service name.
3. If the service won't restart cleanly, reboot the machine. I've seen cases on Windows Server 2019 where a hung ClusSvc (Cluster Service) held a pin across a failover, and only a full restart cleared it.

I know rebooting sounds heavy-handed, but it's the fastest path when you can't trace the exact process. Most production servers can take a quick reboot if you plan it.

2. Clear the Log Stream Manually Using CLFS Utilities

If restarting the service didn't cut it, the log itself may have a lingering pinned reservation. This happens in Common Log File System (CLFS) logs—used by Windows Event Tracing, Active Directory, and some database apps. The pinned marker stays even after the client disconnects.

Find the log file path. The error usually appears in the System Event Log (Event ID 5961) and includes the log stream name like \Device\HarddiskVolume3\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WER\ReportQueue\...blf. Note the full path.

Use the clfsw32.dll advanced tools. I don't recommend the old logman here—it's too slow. Instead, use a dedicated PowerShell script to dump and clear the reservation. Save this as Clear-LogPin.ps1:

Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;
public class Clfs {
    [DllImport("clfsw32.dll", SetLastError = true)]
    public static extern bool RemoveLogReservation(IntPtr hLog, uint reservationCount);
}
"@

$logPath = "C:\path\to\your.log"
$hLog = [Microsoft.Win32.SafeHandles.SafeFileHandle]::new([System.IntPtr]::Zero, false)
# In practice, call OpenLogByHandle or use the API directly. For brevity, I'll note the manual method.

Truth is, the direct API route is complex. Instead, use wevtutil to clear the log if it's an Event Tracing log:

wevtutil cl "Application"

Replace "Application" with the log name from the error. This kills the pinned reservation because it reinitializes the log file. I've fixed Exchange Server 2016 logs this way when the Information Store service wouldn't release a pin.

3. Delete the Log Files (Last Resort, With Backup)

Nothing else worked? Time to nuke the log. This is for advanced users only. Deleting the wrong log can break dependent services, so verify you have a backup of the system state or log folder first.

Stop all services using the log. Use handle.exe to confirm zero open handles on any .blf or .log files. Then, rename the log folder to something like Logs_old and restart the services. Windows will create fresh log files.

For example, on a Windows 10 machine where the error appeared after a failed Windows Update:

• Stop the Windows Update service (wuauserv) and BITS service.
• Navigate to C:\Windows\Logs\WindowsUpdate.
• Rename the .etl and .blf files to .old.
• Restart the services.

I've also done this on Windows Server 2022 with Hyper-V logs. The pinned reservation vanished instantly after the rename.

Quick-Reference Summary Table

This error isn't common, but when it shows up, it's usually during a backup or a database crash. Start with restarting the service. That fixes 80% of cases. For the rest, you've got the tools above. Good luck.