Symptoms
Consider the following scenario:
-
You log on to a remote computer that is running Windows Server 2008 Service Pack 2 (SP2) or Windows Vista SP2 by using a user account.
-
The user account is a member of the Event Log Readers group on the remote computer.
-
You open the security event log.
In this scenario, the description of each log is not displayed correctly. For example, the description of each log resembles the following:
The description for Event ID 4624 from source Microsoft-Windows-Security-Auditing cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
Note This issue also occurs when update 961099 is installed on a remote computer that does not have SP2 installed.
Resolution
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in WindowsTo have us fix this problem for you, go to the "Fix it for me" section. If you prefer to fix this problem yourself, go to the "Let me fix it myself" section.
Fix it for me
To fix this problem automatically, click the Fix it button or link. Then click Run in the File Download dialog box, and follow the steps in the Fix it wizard.
Notes
-
This wizard may be in English only. However, the automatic fix also works for other language versions of Windows.
-
If you are not on the computer that has the problem, save the Fix it solution to a flash drive or a CD and then run it on the computer that has the problem.
Then, go to the "Did this fix the problem?" section.
Let me fix it myself
-
Open Registry Editor. To do this, click Start, type regedit in the Start Search box, and then press Enter.
-
Locate and then click the following registry keys: HKEY_LOCAL_MACHINES\System\CurrentControlSet\services\eventlog\Security\Microsoft-Windows-Security-Auditing
-
Right click Microsoft-Windows-Security-Auditing in the left pane, and then click Permissions….
-
Click the Add… button in the permission dialog.
-
In the Enter the object names to select box, type Event Log Readers, and then click the Check Names button.
-
Click OK to close all dialog windows.
Did this fix the problem?
-
Check whether the problem is fixed. If the problem is fixed, you are finished with this section. If the problem is not fixed, you can contact support.
-
We would appreciate your feedback. To provide feedback or to report any issues with this solution, please leave a comment on the "Fix it for me" blog or send us an email message.
