What does Windows error code 6646 (ERROR_LOG_INCONSISTENT_SECURITY) mean?

ERROR_LOG_INCONSISTENT_SECURITY

Security on the log and its containers is inconsistent.

The native value for ERROR_LOG_INCONSISTENT_SECURITY is 6646 (0x000019F6). Preserve this result immediately after the failing Windows call because later logging, cleanup, LDAP, RPC, or file operations can replace the last-error value.

This result belongs to Common Log File System (CLFS). A diagnosis of it must connect the condition to the producing API, current state, object identity, and first lower-level diagnostic.

Where the result appears

• opening a log copied from another server.
• adding a container created under a different identity.
• restoring containers separately.
• changing permissions on a log directory or NTFS stream.

State boundary to prove

This result applies to inconsistent security descriptors across a CLFS log and its containers and does not by itself prove that the entire server, directory, disk, session, or application is unavailable. The state boundary to prove for this Win32 error is whether the base log and every container expose a compatible owner, DACL, integrity level, and access policy. Use security descriptor for base log and each container, owner and inheritance flags, and service token and privileges as independent evidence. When evidence for this Win32 error disagrees, preserve timestamps and investigate the transition instead of selecting the most convenient value.

Likely causes

• a container inherited a different ACL.
• owner or integrity information differs from the base log.
• backup restored data without matching security metadata.
• manual permission changes touched only part of the log.
• service identities changed without an ACL migration.

Diagnostic sequence

1. capture error 6646 immediately at the API boundary and record the operation that was attempted.
2. identify the exact owner of inconsistent security descriptors across a CLFS log and its containers, including object generation, server, path, session, replica, or client context.
3. collect security descriptor for base log and each container before restarting a service or changing configuration.
4. compare owner and inheritance flags with the documented or observed precondition.
5. correlate service token and privileges with the owning application log, CLFS-related System events, storage events, and any transaction or recovery trace.
6. determine whether side effects occurred and verify recovery after changing one responsible condition.

Evidence to collect

• security descriptor for base log and each container.
• owner and inheritance flags.
• service token and privileges.
• backup/restore method.
• audit events showing permission changes.

Correlate it with the owning application log, CLFS-related System events, storage events, and any transaction or recovery trace. Keep the first detailed status even when a later wrapper translates it to error 6646; the first status often distinguishes transport, authorization, storage, schema, state, and application-integrity causes that share the same final Win32 result.

Handling, retry, and recovery

The recovery objective is to derive the intended security descriptor from the owning application, apply it consistently to the complete log set, verify effective access as the service identity, and then reopen the log.

Retry it only after the recorded condition changes and completion state is known. Idempotent queries may be repeated after recovery, but mutations require a state check first; backoff cannot repair malformed input, corruption, missing structure, or policy rejection.

Telemetry and support fields

• record log_inconsistent_security_api for the producing function or management operation.
• record log_inconsistent_security_target for the file, log, session, replica, object, or server identity.
• record log_inconsistent_security_state_before and log_inconsistent_security_requested_transition.
• record log_inconsistent_security_first_status for the earliest lower-level diagnostic.

For support escalation involving it, retain decimal 6646, hexadecimal 0x000019F6, the API, UTC time, target identity, and first subsystem-specific status. Include the smallest reproducible request and evidence that distinguishes this condition from nearby codes. In the context of it, clfs clients can run in user mode or kernel mode, so the same win32 result may be returned through an application wrapper, a service, or a driver-facing management path.

Difference from nearby results

ERROR_ACCESS_DENIED reports one failed access check; this code reports that the log set itself has inconsistent security configuration.

Practical validation scenario

A restored base log keeps its original ACL while one container inherits permissions from a new folder. Aligning owner and DACL across the set allows CLFS to open the log safely. The negative test should preserve the responsible condition and reproduce it; the recovery test should change only the identified cause, repeat the same operation, and verify both success and the absence of an unintended partial side effect.

Developer and administrator guidance

Administrators handling it should preserve the complete CLFS set—base log, containers, security metadata, and application checkpoint state—before repair. Developers should never delete or recreate a container merely because its path appears in the error; the owning recovery protocol determines whether that data is still required. Code that exposes it through RPC, JSON, REST, PowerShell, or another protocol should preserve the Win32 domain, decimal 6646, hexadecimal 0x000019F6, and original component diagnostic.

References

• Microsoft: Win32 system error range containing this code — official context relevant to it.
• Microsoft: Common Log File System — official context relevant to it.
• Microsoft: Creating a Log File — official context relevant to it.
• Microsoft: Introduction to CLFS — official context relevant to it.

Looking for a different code? Search another status or error code.