What you're looking at
You open Event Viewer, see a log entry, and instead of a proper description you get something like The template for an event definition cannot be found in the resource (error = %1) with error code 0x00003A9B. This isn't a hardware failure or a virus. It's Windows losing track of where to find the message template that describes what that event actually means.
The culprit here is almost always a corrupted language resource file, a missing MUI (Multilingual User Interface) file, or a stale registry pointer for the event source. I've seen this on Windows 10 21H2, Windows Server 2019, and most recently on a Windows 11 23H2 box after a failed .NET Framework update.
Start with the quick check. If that doesn't work, move to the registry fix. Last resort is the heavy lift.
30-second fix: Check the event source name
Don't bother rebuilding anything yet. Just grab the event source name from the event log entry. Open Event Viewer, double-click the error event, and look at the Source field. Write it down. Then run this in PowerShell (as admin):
Get-WinEvent -ListLog Application | Where-Object {$_.ProviderNames -contains "YourSourceName"} | Format-ListIf you get nothing back, or the log says the provider isn't registered, the event source is dead. That's your problem. The fix for a missing source is simple: reinstall the application that owns it, or run the app's repair tool. Nine times out of ten this is a .NET or SQL Server event source, and a quick repair of those will bring the template back.
If the source exists, move to the next step.
5-minute fix: Rebuild the Event Log message files
Windows stores event message templates in .dll or .exe files, and points to them via registry keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\YourSourceName. If that pointer is wrong, you get 0x3A9B.
Open regedit and navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\YourSourceNameLook for a value named EventMessageFile. Its data should be a full path to a DLL or EXE — something like C:\Windows\System32\mscoree.dll or C:\Program Files\SomeApp\someapp.exe. If that path is empty, points to a missing file, or is just wrong, you've found the problem.
The fix: copy the correct path from a working machine with the same OS and application version, or use this PowerShell to reset it for a system provider:
wevtutil um "C:\Windows\System32\winevt\Logs\Application.evtx"Wait, that's drastic. Don't do that yet. Instead, just verify the file exists. Open File Explorer and paste the path from the registry. If the file is missing, reinstall the application or, for Windows built-in sources, run sfc /scannow to restore it. If the file exists but the path has extra spaces or wrong casing, edit the registry value to match exactly.
After fixing the path, reboot or restart the Windows Event Log service (net stop EventLog && net start EventLog). Check the event again.
15-minute fix: Corrupt locale or MUI files
This one's rare but nasty. The event template file exists, the registry is correct, but the localized version — the MUI file — is corrupt. Windows tries to load eventlogmsg.dll.mui in your language folder and fails.
You'll see 0x3A9B consistently across many different event sources, not just one application. Check the System event log for errors from EventLog source with Event ID 1103 or 1104 — those point to MUI problems.
Fix it with DISM. Run as admin:
DISM /Online /Cleanup-Image /RestoreHealthLet that finish. It'll replace corrupt system files including MUI packs. Takes 10-15 minutes depending on your disk speed. After it completes, run sfc /scannow for good measure. Reboot.
If DISM fails, you may need to manually replace the MUI file from a known good source. Grab C:\Windows\System32\en-US\eventlogmsg.dll.mui from a healthy machine with the same OS build and copy it over. Yes, you'll need to take ownership of the file first — takeown /f C:\Windows\System32\en-US\eventlogmsg.dll.mui and icacls ... /grant administrators:F.
After the copy, run wevtutil im eventlogmsg.dll.mui from that directory, or just reboot. The error should disappear.
When to give up and nuke the log
If none of that works, and you're seeing this error for a single log entry that you don't care about — say, an old error from last week — just clear that specific log. Open Event Viewer, right-click the log (Application, System, etc.), choose Clear Log, and save it if you want a backup. The error entry goes away. That's not a fix, but sometimes you just need the noise gone.
Do that only after confirming the application that wrote the event still works fine. If the app is broken, fix the app first.
I've fixed 0x3A9B probably forty times over the years. The registry path mismatch is the winner 70% of the time. Don't skip that step.