EventViewer Error “local computer may not have the necessary registry”

eventviewerwindows-event-logwindows-server-2008-r2windows-server-2012-r2

I am trying to review event viewer logs that was archived from another Server.

When accessed, the events are listed properly, but details of each event give the following error:

The description for Event ID …. in Source "Microsoft-Windows-Security-Auditing" cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer

Unfortunately, the server version where those logs we're archived is inaccessible at the moment.

Is there any way to get the details of the archived event?

Best Answer

This blog article explains why this happens and how to (potentially) resolve it: https://www.eventsentry.com/blog/2008/04/event-log-message-files-the-de.html

Related Topic