Event forwarding not displaying full message

hi

i've set evetn forwarding , great messages not display full description. collector server 2008 r2 sp1 , clients windows xp sp3

this seem quite common isssue , i've read following article

http://social.technet.microsoft.com/forums/en/winservermanagement/thread/7c652d50-0440-4b40-8b5d-0f96d96ea239

and impletmented solutions.

so example forwarded event userenv description is

the description event id 1041 source userenv cannot found. either component raises event not installed on local computer or installation corrupted. can install or repair component on local computer.

if event originated on computer, display information had saved event.

the following information included event:

{7b849a69-220f-451e-b3fe-2cb811af94ae}

if in registry following key exists

hkey_local_machine\system\currentcontrolset\services\eventlog\application\userenv , points userenv.dll in system32 folder exists.

i've changed format events still don't full description. userenv.dll different version on client , server copied dll client server , pointed registry entry @ , rebooted still no joy.

any suggestions?

hi

i solved one. i'll illustrate the fix using example of events userenv.

on collector server i opened up

hkey_local_machine\system\currentcontrolset\services\eventlog\application\userenv

and noted eventmessagefile string. it read %systemroot%\system32\userenv.dll

i found copy of userenv.dll on windows xp pc , copied file c:\xp_dll on 2008 server

i pointed

hkey_local_machine\system\currentcontrolset\services\eventlog\application\userenv\eventmessagefile

to c:\xp_dll\userenv.dll

also in hkey_local_machine\system\currentcontrolset\services\eventlog\application\userenv there value providerguid. renamed string old_providerguid.

after making these changes rebooted server , messages userenv displayed correctly.

cheers

p

Windows Server  >  Windows Server General Forum