Microsoft KB Archive/321737

= &quot;Cannot Find the File Specified&quot; Error Message When You View an Event Log of a Remote Windows 2000-based computer =

Article ID: 321737

Article Last Modified on 10/30/2006

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Professional Edition

-



This article was previously published under Q321737



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SYMPTOMS
When you try to view an event log in the Event Viewer of a remote Microsoft Windows 2000-based computer from a Microsoft Windows NT 4.0 computer, you may receive the following error message:

Cannot find the file specified

As a result, you cannot view the event log of the remote Windows 2000-based computer.



CAUSE
This behavior may occur if one or more of the following registry entries that are missing from the registry of the remote Windows 2000-based computer. The following list contains the registry entries for the Application log, the Security log, and the System logs:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System



RESOLUTION
To resolve this behavior, use one of the following methods.

Method 1: Manually Add the Registry Entry for the Event Log
In the registry of the remote Windows 2000-based computer, add the entry for the event log that you want to view. To do this, follow these steps.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

 Click Start, and then click Run. In the Open box, type regedt32, and then click OK. Locate the registry entry for the Application log, the Security log, and the System log, and then add the registry subkey and values that correspond to the event log that you want to view. The registry entry for each log follows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application

Data type: REG_DWORD

Value name: CategoryCount

Value data: 7 (Hex)

Data type: REG_EXPAND_SZ

Value name: CategoryMessageFile

Value data: %SystemRoot%\System32\eventlog.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security

Data type: REG_DWORD

Value name: CategoryCount

Value data: 9 (Hex)

Data type: REG_EXPAND_SZ

Value name: CategoryMessageFile

Value data: %SystemRoot%\System32\MsAuditE.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System

Data type: REG_DWORD

Value name: CategoryCount

Value data: 7 (Hex)

Data type: REG_EXPAND_SZ

Value name: CategoryMessageFile

Value data: %SystemRoot%\System32\eventlog.dll

 Quit Registry Editor.

Example
To add the registry subkey for the System log, follow these steps:  In the Registry Editor, click the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System

</li> To add the System log subkey, follow these steps:  On the Edit menu, click Add Key.</li> In the Add Key dialog box, type System in the Key Name box, and then click OK.</li> Click the subkey that you created. It is in the following location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System

</li></ol> </li> Add the CategoryCount DWORD value. To do so, follow these steps:  On the Edit menu, click Add Value.</li> In the Add Value dialog box, type CategoryCount in the Value Name box, click REG_DWORD in the Data Type box, and then click OK.</li> In the DWORD Editor dialog box, type 7 in the Data box, verify that Hex is selected under Radix, and then click OK.</li></ol> </li> Add the CategoryMessageFile string value. To do so, follow these steps.

NOTE: Make sure that the following registry subkey is selected in the left pane of Registry Editor:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System

 On the Edit menu, click Add Value.</li> In the Add Value dialog box, type CategoryMessageFile in the Value Name box, click REG_EXPAND_SZ in the Data Type box, and then click OK.</li> In the String Editor dialog box, type %SystemRoot%\System32\eventlog.dll in the String box, and then click OK.</li></ol> </li> <li>Quit Registry Editor.</li></ol>

Method 2: Import the Registry Entry for the Event Log
Export the appropriate event log registry subkey from a working Windows 2000-based computer on which the event log can be viewed to a .reg file, and then import the .reg file to the computer that is experiencing the behavior that is described in the &quot;Symptoms&quot; section of this article. To import the .reg file, follow these steps.

NOTE: The computer from which you import the registry subkeys must use the same version of Windows and be similar to, or a duplicate of, the computer that is experiencing the behavior described in the &quot;Symptoms&quot; section of this article.

Step 1: Export the Event Log Registry Keys
<ol> <li>Insert a floppy disk into the floppy disk drive of the computer from which you are exporting event log registry key.</li> <li>Click Start, and then click Run.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\System

</li> <li>Export the registry subkeys that you located in step 4. To export the subkeys, follow these steps for each registry subkey: <ol style="list-style-type: lower-alpha;"> <li>On the File menu, click Export Registry File.</li> <li>In the Save in box of the Export Registry File dialog box, click 3 Floppy(A:), type a name for the file in the File name box, and then click Save.

NOTE: Make sure that you use a different and descriptive name for each .reg file.</li></ol> </li> <li>Click Exit on the File menu to quit Registry Editor.</li></ol>

Step 2: Import the Event Log Registry Keys

 * 1) Insert the floppy disk that contains the .reg files into the floppy disk drive of the computer that is experiencing the behavior described earlier in the &quot;Symptoms&quot; section of this article.
 * 2) Start Windows Explorer, and locate the floppy disk drive.
 * 3) Double-click each .reg file that you created and saved to the floppy disk in Step 1.
 * 4) Click Yes when you are prompted to add information to the registry.
 * 5) Click OK when you receive the message that the information is successfully entered into the registry.

<div class="moreinformation_section">

MORE INFORMATION
For additional information about how to use Event Viewer, click the article number below to view the article in the Microsoft Knowledge Base:

302542 HOW TO: Diagnose System Problems with Event Viewer in Microsoft Windows 2000

Keywords: kbprb KB321737

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.