"Cannot Find the File Specified" Error Message When You View an Event Log of a Remote Windows 2000-based computer (321737)

RESOLUTION

To resolve this behavior, use one of the following methods.

Method 1: Manually Add the Registry Entry for the Event Log

In the registry of the remote Windows 2000-based computer, add the entry for the event log that you want to view. To do this, follow these steps.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

1. Click Start, and then click Run.
2. In the Open box, type regedt32, and then click OK.
3. Locate the registry entry for the Application log, the Security log, and the System log, and then add the registry subkey and values that correspond to the event log that you want to view. The registry entry for each log follows:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application

   Data type: REG_DWORD
   Value name: CategoryCount
   Value data: 7 (Hex)

   Data type: REG_EXPAND_SZ
   Value name: CategoryMessageFile
   Value data: %SystemRoot%\System32\eventlog.dll

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security

   Data type: REG_DWORD
   Value name: CategoryCount
   Value data: 9 (Hex)

   Data type: REG_EXPAND_SZ
   Value name: CategoryMessageFile
   Value data: %SystemRoot%\System32\MsAuditE.dll

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System

   Data type: REG_DWORD
   Value name: CategoryCount
   Value data: 7 (Hex)

   Data type: REG_EXPAND_SZ
   Value name: CategoryMessageFile
   Value data: %SystemRoot%\System32\eventlog.dll

4. Quit Registry Editor.

Example

To add the registry subkey for the System log, follow these steps:

1. In the Registry Editor, click the following registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System

2. To add the System log subkey, follow these steps:
   1. On the Edit menu, click Add Key.
   2. In the Add Key dialog box, type System in the Key Name box, and then click OK.
   3. Click the subkey that you created. It is in the following location:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System

3. Add the CategoryCount DWORD value. To do so, follow these steps:
   1. On the Edit menu, click Add Value.
   2. In the Add Value dialog box, type CategoryCount in the Value Name box, click REG_DWORD in the Data Type box, and then click OK.
   3. In the DWORD Editor dialog box, type 7 in the Data box, verify that Hex is selected under Radix, and then click OK.
4. Add the CategoryMessageFile string value. To do so, follow these steps.
   
   NOTE: Make sure that the following registry subkey is selected in the left pane of Registry Editor:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System

   1. On the Edit menu, click Add Value.
   2. In the Add Value dialog box, type CategoryMessageFile in the Value Name box, click REG_EXPAND_SZ in the Data Type box, and then click OK.
   3. In the String Editor dialog box, type %SystemRoot%\System32\eventlog.dll in the String box, and then click OK.
5. Quit Registry Editor.

Method 2: Import the Registry Entry for the Event Log

Export the appropriate event log registry subkey from a working Windows 2000-based computer on which the event log can be viewed to a .reg file, and then import the .reg file to the computer that is experiencing the behavior that is described in the "Symptoms" section of this article. To import the .reg file, follow these steps.

NOTE: The computer from which you import the registry subkeys must use the same version of Windows and be similar to, or a duplicate of, the computer that is experiencing the behavior described in the "Symptoms" section of this article.

Step 1: Export the Event Log Registry Keys

1. Insert a floppy disk into the floppy disk drive of the computer from which you are exporting event log registry key.
2. Click Start, and then click Run.

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System

3. Export the registry subkeys that you located in step 4. To export the subkeys, follow these steps for each registry subkey:
   1. On the File menu, click Export Registry File.
   2. In the Save in box of the Export Registry File dialog box, click 3 Floppy(A:), type a name for the file in the File name box, and then click Save.
      
      NOTE: Make sure that you use a different and descriptive name for each .reg file.
4. Click Exit on the File menu to quit Registry Editor.

Step 2: Import the Event Log Registry Keys

1. Insert the floppy disk that contains the .reg files into the floppy disk drive of the computer that is experiencing the behavior described earlier in the "Symptoms" section of this article.
2. Start Windows Explorer, and locate the floppy disk drive.
3. Double-click each .reg file that you created and saved to the floppy disk in Step 1.
4. Click Yes when you are prompted to add information to the registry.
5. Click OK when you receive the message that the information is successfully entered into the registry.