Log Dejargonizer

Windows System Log · Event 153

Event 153: A disk read or write had to be retried

Windows asked the disk for something, got no answer in time, and asked again. The retry usually succeeds, so nothing visibly breaks — but the machine froze for the seconds it took, and that is why this event turns up under every complaint about stuttering.

Also written as Event ID 153 diskdisk 153 warningio operation retried event viewer

What it means for you

On a personal computer

Your drive took too long to answer and Windows tried again. If your PC freezes for a few seconds at a time — audio stutters, the mouse still moves but nothing responds — this is very often the reason. A handful over months is fine. Several a day means back up your files now and then work out why.

For an analyst

On physical hardware this is a drive, cable or backplane problem and it precedes outright failure often enough to be worth alerting on. On virtual machines it is usually the host: contended datastores and snapshot consolidation produce guest-side 153s with perfectly healthy virtual disks, so check host latency before touching the guest. Note that 153 replaced the older Event 129 pattern for retries handled by the storage driver rather than reset by the controller.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The IO operation at logical block address 0x1a2b3c4 for Disk 1 (PDO name: \Device\0000002c) was retried.

The fields that decide it

Everything else in the log line is context.

Disk number
Which physical disk, matching the numbering in Disk Management. Map it to a drive letter before assuming which one is at fault — the number is not the letter.
Logical block address
Where on the disk the operation was aimed. Repeated retries at the same or nearby addresses point at a specific bad region rather than a general slowdown.
PDO name
The device object, such as \Device\0000002c. Only useful for matching this event to other storage events on the same device.
Frequency and clustering
Not a field, but the decisive signal. Retries in bursts at the same time of day usually mean backup or antivirus load; retries scattered and increasing mean hardware.
Accompanying events
Whether Events 129, 51 or 55 appear alongside.
  • Event 153 aloneThe driver retried and recovered. Least serious.
  • 153 with 129The controller had to be reset as well. More serious and more likely to be hardware.
  • 153 with 55Retries plus filesystem corruption. Act on this rather than monitoring it.

Ordinary reasons this happens

Most of the time it is one of these.

  • A cheap or nearly full SSD doing garbage collection, which can stall briefly under sustained writes.
  • A USB external drive on a marginal cable or an unpowered hub — by far the most common cause on home machines.
  • A virtual machine whose host storage is busy; the guest sees latency it cannot explain.
  • Antivirus or backup software driving the disk hard enough that ordinary requests miss their deadline.
  • A drive that has just woken from a low-power state, where the first request after spin-up times out.
  • A mechanical drive remapping a sector it found weak, which is the drive working as designed.

When it is not ordinary

Ransomware encrypting at speed, saturating the disk to the point that unrelated requests time out.

What gives it awayA burst of 153s alongside heavy write activity and a sudden change in file extensions. The disk events are a side effect, not the detection.

ATT&CK T1486

Cryptocurrency mining or another resource-consuming process starving legitimate I/O.

What gives it awaySustained retries correlating with a process holding high disk and CPU that nobody can account for.

ATT&CK T1496

What to do next

  1. Count them. Open Event Viewer, filter the System log to Event 153, and look at the spread over the last month rather than the last hour.
  2. Identify the disk. Match the disk number to Disk Management, then to a drive letter, before deciding anything is failing.
  3. If it is an external or USB drive, change the cable and plug it directly into the machine rather than a hub. This resolves a large share of home cases outright.
  4. Read the drive's SMART data with a tool such as CrystalDiskInfo. Reallocated sector counts and pending sectors are what confirm a hardware fault.
  5. Check for Events 129, 51 and 55 in the same window — they escalate the seriousness considerably.
  6. On a virtual machine, look at host datastore latency before touching the guest at all.
  7. If the drive holds anything you care about, take a backup before further diagnosis. Retries are frequently the last warning before the drive stops answering entirely.

Queries to run

powershell Retries per day. A rising count is the signal; the absolute number is not.
Get-WinEvent -FilterHashtable @{LogName='System'; Id=153} -MaxEvents 200 | Group-Object { $_.TimeCreated.Date } | Select-Object Name, Count
powershell Run alongside the event query to map disk numbers to real devices.
Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, MediaType, HealthStatus, OperationalStatus
kql Machines accumulating storage warnings across the estate, with the three related IDs side by side.
Event | where EventLog == 'System' and EventID in (153, 129, 51) | summarize count() by EventID, Computer, bin(TimeGenerated, 1d) | order by Computer asc, TimeGenerated asc

Common questions

Is Event 153 serious?

It depends entirely on how often it happens. A few over several months, especially on a USB drive, are not worth acting on. Several a day, or a count that keeps rising, is one of the clearest warnings Windows gives that a drive is on its way out. Because it is cheap to check, count them before deciding.

Does Event 153 mean my hard drive is failing?

Not by itself. The three common causes are a failing drive, a bad cable or connection, and a system too busy to service the disk in time. Changing the cable is the fastest test on a physical machine, and reading the drive's SMART data is the fastest way to confirm or clear the drive itself.

Why does my PC freeze for a few seconds with Event 153 in the log?

Because a retry takes real time — often several seconds — and everything waiting on that disk stops until it completes. Audio stutters, the mouse keeps moving but nothing responds, and then it all resumes. That pattern with 153s in the log is close to diagnostic of a storage problem rather than a CPU or memory one.

What is the difference between Event 153 and Event 129?

153 means the storage driver retried the operation and the system carried on. 129 means the controller had to be reset, which is a heavier failure affecting every device behind it. 153 alone is a warning; 153 with 129 alongside is a strong indication the hardware or the connection is genuinely faulty.

I get Event 153 on a virtual machine. Is the virtual disk broken?

Almost certainly not. The guest sees the latency but the cause is nearly always on the host — a contended datastore, a snapshot being consolidated, or storage shared with a noisy neighbour. Check host-side latency first; replacing or rebuilding the virtual disk rarely changes anything.

Read next

Mentioned by

Vendor documentation

Last reviewed 6 September 2026