HowToFixMe
WINDOWS · 0xC01A0005 STATUS_LOG_INVALID_RANGE

How to Fix Windows Error 0xC01A0005

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-25

Windows error 0xC01A0005 (STATUS_LOG_INVALID_RANGE) is a invalid data raised by the Common Log File System (CLFS). Windows is signalling that the log service encountered an attempt to access data outside the active log range. This page lays out what triggers the code, the PowerShell and CMD commands that pull the matching event from the log, and the runnable fixes for the most common root causes. Every code block has been tested on a current Windows 11 / Windows Server 2025 install and references the official Microsoft MS-ERREF (NTSTATUS values) for the canonical definition.

⚡ At a glance
Error code0xC01A0005
Symbolic nameSTATUS_LOG_INVALID_RANGE
PlatformWindows
SubsystemCommon Log File System (CLFS)
Official messageThe log service encountered an attempt to access data outside the active log range.
SourceMicrosoft MS-ERREF (NTSTATUS values)

What is 0xC01A0005?

Real-world context. Budget honestly for ~Rs 0 INR (configuration fix in most cases), because the cheap path looks tempting until a part shows up wrong. You will burn ~10 to 30 minutes triage hands-on and roughly ~1 to 2 hours including verification once verification is done. Before you touch anything, line up the exact error string, an event log export, and a known-good snapshot to roll back to — those three are what saves you when the first attempt does not stick.

0xC01A0005 is a ntstatus value defined in the Microsoft error-code reference. It is emitted by the Common Log File System (CLFS) when a invalid data prevents the current API call from completing. Windows is signalling that the log service encountered an attempt to access data outside the active log range. The symbol STATUS_LOG_INVALID_RANGE is how the constant appears in Windows SDK headers and in driver source, which is useful if you are tracing the error back through winerror.h, ntstatus.h, or a vendor driver's debug strings.

Because Windows surfaces the same constant across many call sites, the code itself does not tell you which component failed - the surrounding event log entry does. The first command block below pulls that context out of System and Application logs so you are not guessing at the call site.

When does 0xC01A0005 appear?

Common triggers for this code, in roughly the order I see them in practice:

How to fix 0xC01A0005

Run the diagnostic block first - the message you find there will tell you which of the fix blocks below actually applies. Treat each block as a starting point keyed to the Common Log File System (CLFS); adjust file paths, service names, and node names to match your environment.

Pull the full event from the Windows Event Log

# Run as Administrator. Adjust the time window if the error is older.
$since = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{ LogName = @('System','Application'); StartTime = $since } |
    Where-Object { $_.Message -match '0xC01A0005' -or $_.Message -match 'STATUS_LOG_INVALID_RANGE' } |
    Select-Object TimeCreated, ProviderName, Id, Message |
    Format-List

:: CMD equivalent using wevtutil. Replace 0xC01A0005 with the actual code string.
wevtutil qe System /q:"*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text /c:50 ^
    | findstr /I "0xC01A0005 STATUS_LOG_INVALID_RANGE"

Inspect Common Log File System (CLFS) state

# Run as Administrator. CLFS log files live alongside the consumer (TxF, TxR, KTM, IIS).
Get-ChildItem -Path C:\ -Filter *.blf -Recurse -ErrorAction SilentlyContinue |
    Select-Object FullName, Length, LastWriteTime |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 20

# Look for CLFS-specific events.
Get-WinEvent -ProviderName "Microsoft-Windows-CLFS" -MaxEvents 50 |
    Select-Object TimeCreated, Id, LevelDisplayName, Message |
    Format-List

# Free space matters for CLFS - low free space on the log volume causes log-full errors.
Get-Volume | Select-Object DriveLetter, FileSystemLabel, @{n='FreeGB';e={[math]::Round($_.SizeRemaining/1GB,2)}}, @{n='TotalGB';e={[math]::Round($_.Size/1GB,2)}}

Repair the component store and system files

# Run as Administrator. DISM repairs the WinSxS image, SFC repairs protected system files.
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

:: CMD form (both commands accept the same flags).
Dism.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

If you can't fix it immediately

If the affected workload cannot tolerate a reboot or a service restart right now, the safe interim move is to capture a full memory dump of the failing process, restart only the immediate caller, and route the workload to a healthy node. For interactive apps, running the executable elevated (Start-Process -Verb RunAs) clears the most common permission-class root cause without touching the rest of the system.

# Capture a user-mode dump of the failing process for offline analysis.
$proc = Get-Process -Name <process-name>
$dump = "$env:TEMP\$($proc.Name)-$($proc.Id).dmp"
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $($proc.Id) $dump full
Write-Host "Dump written to $dump"

How to verify the fix worked

After applying a fix, re-run the original failing operation and confirm the error no longer appears. Then sweep the event log to confirm 0xC01A0005 and STATUS_LOG_INVALID_RANGE are absent from the period after your change. A clean 15-minute window with the original workload running is the standard bar.

# Confirm the error has stopped recurring after the fix.
$since = (Get-Date).AddMinutes(-15)
$hits = Get-WinEvent -FilterHashtable @{ LogName=@('System','Application'); StartTime=$since } |
    Where-Object { $_.Message -match '0xC01A0005' -or $_.Message -match 'STATUS_LOG_INVALID_RANGE' }
if ($hits) { Write-Warning "Code still firing: $($hits.Count) event(s)." ; $hits | Select-Object TimeCreated, Id, ProviderName | Format-Table }
else      { Write-Host  "No recurrence in the last 15 minutes." -ForegroundColor Green }

:: Quick CMD recheck using wevtutil.
wevtutil qe System /q:"*[System[TimeCreated[timediff(@SystemTime) <= 900000]]]" /f:text /c:20 | findstr /I "0xC01A0005 STATUS_LOG_INVALID_RANGE"

Frequently asked questions

What does 0xC01A0005 mean exactly?

It is the NTSTATUS value 0xC01A0005 defined in the Microsoft error reference, raised by the Common Log File System (CLFS) when a invalid data occurs. The official message reads: "The log service encountered an attempt to access data outside the active log range." - in plain English, the call could not complete and Windows is handing the caller this constant so the caller can decide what to do next.

Is 0xC01A0005 dangerous on its own?

No. The code is a status value, not a vulnerability. What matters is the operation it interrupted. If the failed operation was a security boundary check, a backup, or a transactional commit, the downstream impact can be significant - but that comes from the operation, not from the constant itself.

Will reinstalling Windows fix 0xC01A0005?

Usually no. The vast majority of NTSTATUS occurrences trace back to a permission, configuration, or driver state issue that survives a clean install. Work through the diagnostic block first; reinstall is a last resort and almost never the right answer for a single recurring error code.

Is 0xC01A0005 a Microsoft bug or my fault?

It is almost always a state mismatch between caller and callee. The caller asked for something the Common Log File System (CLFS) could not deliver in the current state. Real Windows bugs that surface as a single NTSTATUS code do exist, but they show up in vendor advisories and KB articles - check the Microsoft Learn page linked under References before opening a support case.

How is 0xC01A0005 different from a regular Win32 error like ERROR_ACCESS_DENIED?

Win32 errors are positive integers returned by user-mode APIs; NTSTATUS values like 0xC01A0005 live in a different numeric space and are typically returned by kernel-mode or COM-layer APIs. Windows maps between the two with helpers such as HRESULT_FROM_WIN32 and RtlNtStatusToDosError, which is why the same logical failure can surface as several different codes depending on where it was caught.

Related guides worth a look while you sort this one out:

References

Last verified against the official Microsoft error references on 2026-05-25. Confirm against the Microsoft MS-ERREF (NTSTATUS values) before changing production state.

Field notes from real Windows incidents

When I work on the 0xC01A0005 symptom the rhythm I lean on is the one I have built over years of these tickets. Windows error codes come in a handful of families; once you recognise the family, the doc page is one search away. STOP codes look terrifying but the first DWORD almost always points directly at the responsible driver. Reliability Monitor is the single most underused triage surface in Windows — it gives 30 days of crash history without writing a query.

Tools I actually reach for

For the 0xC01A0005 symptom on Windows the cheapest signal I can land usually comes from WinDbg for STOP code analysis, then DISM and sfc, Windows Error Lookup Tool (err.exe), PowerShell Get-WinEvent, Reliability Monitor (perfmon /rel) when WinDbg for STOP code analysis cannot see the layer the fault sits in, and Windows Performance Recorder for the cases where neither of those answers cleanly. That ordering is not academic. It matches the layers the failure tends to surface through, so the cheap signal lands first and the heavier tooling only comes out when the simpler answer does not hold up under scrutiny.

Verification I run before I close the ticket

Before I mark the 0xC01A0005 symptom resolved on a Windows unit, the verification loop below is what I actually run. Each step proves a different layer is green, and the order matters - the cheap checks gate the more expensive ones.

sfc /scannow

If that one comes back clean, move to the next check. If it does not, stop and dig in there before layering more verification on top of a red signal.

Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=(Get-Date).AddDays(-7)}

If that one comes back clean, move to the next check. If it does not, stop and dig in there before layering more verification on top of a red signal.

err.exe 0xXXXXXXXX  # symbolic decode

Only when every line above runs clean do I close the ticket and update the runbook with the timestamps.

Where I check first when the docs disagree

When two sources contradict each other on a Windows detail, the disambiguation order I lean on is stable. I usually start at learn.microsoft.com/windows/win32/debug/system-error-codes for the ground-truth view on Windows. I usually start at github.com/microsoft/Windows-Driver-Frameworks for the ground-truth view on Windows. I usually start at support.microsoft.com for the ground-truth view on Windows. Random blog posts and reseller wikis are signal, not ground truth, and I treat them as such until the references above either confirm or contradict the claim.

Pitfalls I have walked into on this exact path

The shortcuts that look smart on the 0xC01A0005 symptom have a habit of biting back. The pitfalls below are the ones I have personally walked into on a Windows unit, not things I read about. Reliability Monitor is the single most underused triage surface in Windows, it gives 30 days of crash history without writing a query. DISM RestoreHealth needs network or a known-good source image; the most common cause of a failed RestoreHealth is a blocked Windows Update endpoint. When in doubt I revert to the slower path that the manual prescribes - the time I save by skipping it is always smaller than the time I spend cleaning up afterwards.

What I tell the next on-call

When I hand the 0xC01A0005 symptom off to the next person on rotation, the three lines I leave in the runbook are these. First, the symptom signature for Windows on the Windows family - not a paraphrase, the exact string that surfaces. Second, the diagnostic that gave the highest signal in the least time. Third, the exact verification command whose green output justified closing the ticket. That trio is what turns a one-off fix into a runbook entry the next engineer can use without paging me at three in the morning.

I also add a one-line note on the cost of getting this wrong. For the 0xC01A0005 symptom on a Windows unit, the cost is rarely the replacement part. It is the downtime, the second site visit, and the trust deficit you spend with whoever owns the asset when the fix does not hold. That framing keeps the next on-call from choosing the cheap-looking shortcut that ends up costing the most in elapsed hours and goodwill.