When running under a limited account, local event log messages are displaying fine, for remote computer I am getting this error:

The description for Event ID ( xxxxx ) in Source ( yyyyy ) cannot be found.
The local computer may not have the necessary registry information or message 
DLL files to display messages from a remote computer. You may be able to use the
/AUXSOURCE= flag to retrieve this description; see Help and Support for details.
The following information is part of the event: zzzzz.

Same remote computer works fine under domain administrator. I am currently experimenting with just the Event Viewer, by using Run As. Original issue is a PowerShell script which does Get-EventLog.

Are there any special permissions that need to be in place to able to read event log messages remotely? Supposedly there is a simple solution in Windows 2008 and higher, i.e. just add user to Event Log Readers group. Is there anything like that for Windows 2003?

  • @Ansgar: It applies to all log entries, not just some of them. I tried as Domain Administrator, and also as a limited account - and got different outcome. So by raising permission I got from non-working to working. And you are telling me this is not about permissions?.. – Neolisk Sep 18 '12 at 1:47
  • @Ansgar doesn't seem to know what he's talking about in this case. You have clearly identified that this is a permissions issue. – Lucky Luke Oct 12 '12 at 14:12

I believe the issue is not so much that the user can't read the event log, but that the user can't read the event log message files which are used for these particular events.

My blog entry may help shed some light: http://www.eventlogblog.com/blog/2008/04/event-log-message-files-the-de.html.

On the remote system you would need to identify the message files which are used by the particular event source, and then ensure that the user who is running the powershell script has read permission to those files.

I haven't tried this, but it should work.

| improve this answer | |
  • Worked for me. Don't forget that the account running the script needs to be able to read the message file AND the registry key that points to them. – Spamwich Feb 3 '17 at 22:29

This is what exists for Windows 2003, although very complicated and hard to maintain. Solution uses SDDL.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.