locked
event log message not founds ... RRS feed

  • Question

  • Has anyone worked out which files are missing/needed in order to populate the event logs with meaningful

    messages as opposed to "I couldn't find that ..." for a large number of events.

     

    Better yet, does anyone have a macro component for "solve all event log missing messages"?

     

     

    Wednesday, May 21, 2008 6:48 AM

Answers

  • Found it...

     

    We are no longer getting the “The description for Event ID… blah blah blah”  in the logs anymore.

    Again, this is what we did for security, however could also be used for Application and System if needed.

    On a regular XP desktop perform the following:

    In regedit go to HKLM\System\CurrentControlSet\Services\Eventlog

    If you right click the Security folder and select Export, then save the file someplace accessible.

    If you browse through the folders in regedit, you will see references to DLL files.

    In C:\Windows\System32  copy msaudite.dll and msobjs.dll to the same place you put the Export file.

    Copy the two DLL files into the System32 folder on the Thin Client.

    Double click the exported Reg file and select Merge.

    After you commit the changes and reboot, the Security log will be populated with information and not the error above.

    This process will also work for the Application and System, however I’m not sure about the DLL files that would be needed at the moment.

    Friday, May 30, 2008 4:30 PM

All replies

  •  

    I was having the same problem and wound up going through the registry searching for the references to the event logs. They reference DLL files (i was looking for the write up I did on it but can't find it at the moment) and I just copied them from the XP pro machine into the system32 folder on XPE.  Then I actually had meaningful event logs again.
    Friday, May 30, 2008 4:20 PM
  • Found it...

     

    We are no longer getting the “The description for Event ID… blah blah blah”  in the logs anymore.

    Again, this is what we did for security, however could also be used for Application and System if needed.

    On a regular XP desktop perform the following:

    In regedit go to HKLM\System\CurrentControlSet\Services\Eventlog

    If you right click the Security folder and select Export, then save the file someplace accessible.

    If you browse through the folders in regedit, you will see references to DLL files.

    In C:\Windows\System32  copy msaudite.dll and msobjs.dll to the same place you put the Export file.

    Copy the two DLL files into the System32 folder on the Thin Client.

    Double click the exported Reg file and select Merge.

    After you commit the changes and reboot, the Security log will be populated with information and not the error above.

    This process will also work for the Application and System, however I’m not sure about the DLL files that would be needed at the moment.

    Friday, May 30, 2008 4:30 PM