Missing help component??

[Lucas]

Hi!

When looking in eventviewer, in security i see the following:

The description for Event ID ( <####> ) in Source (<application name>) could
not be found. It contains the following insertion string(s): <the text of
the message logged by ReportEvent>.


Any idea of what dlls or components I'm missing to get the it to display the
event correctly??


Thanks
Lucas

 

[Lucas]

Hi!

I did some more research....this is ths problem:

When I open event viewer I go to the Security Evenlog and click on one of
the Audits and see the following message:
----------
The description for Event ID ( 577 ) in Source ( Security ) cannot be found.
The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event: NT
Local Security Authority / Authentication Service;
LsaRegisterLogonProcess(); MPC3$; WORKGROUP; (0x0,0x3E7); MPC3$; WORKGROUP;
(0x0,0x3E7); SeTcbPrivilege.
----------
Okie, hmm, so I go to the registry
HKLM\System\CurrentControlSet\Services\Eventlog\Security

and its empty, I check the Application subkey and it contains resources.
Then I check the same keys in a XP Pro and the security subkey also contains
resources.

So my question is: is there a component that activates the security evenlog?
Any other suggestions??

Thanks for your help...
Lucas

 

[KM]

Lucas,

Please search NG archive for drvmain.sdb:
http://groups.google.com/groups?hl=...a=group=microsoft.public.windowsxp.embedded.*

Basically, you would need to copy this file to the run time manually (or though your component).
IIRC, there have been a QFE that fixed the problem.

 

[Lucas]

Hi KM and all other readers....

I checked my image and I have already applied the QFE that you mentioned in
the newsgroup, I also already have drvmain.sdb in my image.
I added the component "Software Installation Group Policy Extension" and
rebuilt my image.

Still the same problem. I should mention that I'm not using winlogon.

Still Can't find EventID. Any other suggestions? This is a headache...

Thanks for all your help
Lucas

 

[Doug Hoeffel]

Lucas:

Try adding the following to your registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\Secu
rity]
"CategoryCount"=dword:00000009
"CategoryMessageFile"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73
,\
74,65,6d,33,32,5c,4d,73,41,75,64,69,74,45,2e,64,6c,6c,00
"GuidMessageFile"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,
65,\
6d,33,32,5c,4e,74,4d,61,72,74,61,2e,64,6c,6c,00
"EventMessageFile"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74
,\
65,6d,33,32,5c,4d,73,41,75,64,69,74,45,2e,64,6c,6c,00
"ParameterMessageFile"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,7
3,\
74,65,6d,33,32,5c,4d,73,4f,62,6a,73,2e,64,6c,6c,00
"TypesSupported"=dword:0000001c

HTH... Doug

 

[KM]

Lucas,

I have been out for a while and couldn't reply you.
Anyway, I think Doug's reply helped you already. Please let us know the result for future reference.

Also, here is a good article for you that I ran across a long while ago to get more familiar with Event Viewer registry and etc.:
http://www.codeproject.com/dotnet/evtvwr.asp