STATUS_NO_EVENT_PAIR (0XC000014E) Quick Fix on Windows Server

Quick answer

Stop the Event Log service, rename or delete the corrupted log file pair (usually Security.evtx and its backup), restart the service. Use wevtutil gl Security and wevtutil cl Security to clear the log if rename doesn't work.

What's actually happening?

This error shows up when Windows Event Log can't find a paired log file. Every event log (like Security, Application, System) has a primary .evtx file and a backup file that stores old events. When one gets corrupted or deleted while the other is intact, the system throws STATUS_NO_EVENT_PAIR (0XC000014E). I've seen this most often after a failed backup operation on Windows Server 2016 and 2019—specifically when someone canceled a VSS backup mid-write. The log becomes orphaned. You'll see it in Event Viewer as a blank window or in backup logs as a failed task.

Had a client last month running Server 2019 whose nightly backup job kept failing with this exact code. Turned out a rogue antivirus scan had locked the Security.evtx file, the backup couldn't read it, and the log pair got scrambled. Took me 10 minutes to sort. Here's how.

Fix steps (numbered)

Open PowerShell or Command Prompt as Administrator. Don't skip this—without admin rights you can't touch the Event Log files.
Stop the Windows Event Log service:
```
net stop EventLog
```
Wait for it to confirm stopped. If it hangs, force it: sc stop EventLog.
Navigate to the log folder:
```
cd %SystemRoot%\System32\winevt\Logs
```
List the files to find the corrupted pair. Common culprits are Security.evtx and Application.evtx. Check the backup files too—there's usually a Security.evtx.bak or similar. If you see a .bak file that's larger than the primary, that's the issue.
Rename the primary log file (don't delete yet):
```
ren Security.evtx Security.old.evtx
```
Do the same for any backup pair file you suspect is corrupt:
```
ren Security.evtx.bak Security.old.evtx.bak
```
Restart the Event Log service:
```
net start EventLog
```
Open Event Viewer and check if the log loads. If it does, great—Windows will create a fresh .evtx file automatically. If you still see the error or an empty log, use wevtutil to reset it:
```
wevtutil cl Security
```
This clears the log metadata and rebuilds the pair. Use wevtutil gl Security first to see the current status.

Alternative fixes if the main one fails

If you can't stop the EventLog service (rare, but happens when the system locks it): restart the server in Safe Mode with Networking. Then run the rename steps. Done this on a Domain Controller where the security log was pinned by Active Directory.
If renaming doesn't fix it and you get access denied: take ownership of the file with takeown /f C:\Windows\System32\winevt\Logs\Security.evtx then grant yourself full control: icacls Security.evtx /grant Administrator:F. Then retry the rename.
If the error is tied to a specific backup software (like Veeam or Windows Server Backup): check the backup logs for the exact log name being accessed. Sometimes the software uses a custom log—say Backup.evtx. In that case, apply the same rename/reset to that custom log.

Prevention tip

Stop VSS-aware backup software from hammering the event logs during peak usage. Schedule backups during low activity (like 2 AM). Also, set event log max sizes to something reasonable—don't let them grow to 1 GB. Use Group Policy to limit Security log to 128 MB and set retention to overwrite as needed. That way, a backup failure won't leave a giant half-written pair.