You open Event Viewer, click on a log entry, and instead of a description you get ERROR_EVT_MESSAGE_NOT_FOUND (0X00003AB3). Usually this happens right after a software install, a Windows update, or when you're looking at logs from a third-party app that was uninstalled but left its registry entries behind. The event has a source, but the system can't find the message DLL that translates the numeric event ID into human-readable text.
Here's what's going on: every event log entry contains an event ID and a source name. The source maps to a provider, and that provider has a registry key that points to a message file—usually a DLL or EXE. That file contains a string table with the descriptions. When the file is missing, moved, or the registry path is wrong, Windows can't find the message. It's not a data corruption issue; it's a broken reference.
I've seen this with old Norton products, custom in-house apps, and even some Windows updates that didn't clean up after themselves. The fix is to find the broken provider and either repair the path or re-register it.
Step 1: Identify the Source of the Broken Event
Open Event Viewer, locate the event that shows the error, and note the Source and Event ID in the General tab. You'll need both for the next steps.
Step 2: Find the Provider's Registry Key
Each event source is registered under HKLM\SYSTEM\CurrentControlSet\Services\EventLog\. The subkey is named after the log (e.g., Application, System), and inside that, you'll find a subkey for the source name.
Open regedit.exe and navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\<Source Name>Replace <Source Name> with the source you noted. If it's in the System log, use System instead of Application.
Step 3: Check the Message DLL Path
In that registry key, look for the EventMessageFile value. It's a REG_EXPAND_SZ or REG_SZ that contains a path to a DLL or EXE. Copy that path and check if the file actually exists.
If the file doesn't exist, that's your problem. If it does exist, the path might be malformed (relative, or using environment variables that aren't set).
Step 4: Repair or Remove the Broken Registration
If the file is missing, and the source belongs to a program you no longer use, you can simply delete the registry key for that source. That will stop the error, but you'll lose the ability to see any future events from that source (if the program comes back).
If the file exists but the path is wrong, update the EventMessageFile value with the correct full path. For example, if the DLL is in C:\Program Files\MyApp\myapp.dll, set the value to that path.
If you're unsure about the correct path, you can use the wevtutil tool to re-register the provider if it's a Windows component. Open an elevated Command Prompt and run:
wevtutil im <provider-name>.manBut for third-party apps, it's often easier to reinstall the application, which will fix the registration.
Step 5: Clear and Re-Log the Event
After fixing the registry, you need to clear the old event so it doesn't show the error anymore. Right-click the log in Event Viewer (e.g., Application) and select Clear Log…. Then generate a new event by restarting the service or app that generated the old one.
Still Seeing the Error?
If the error persists, there are a few more things to check:
- Check the parameter file – Some providers also have a
ParameterMessageFilevalue. Make sure that file exists too. - Check 32-bit vs 64-bit – On 64-bit Windows, a 32-bit provider might be pointing to a file in
C:\Windows\SysWOW64but the registry path is in the 64-bit view. Look underHKLM\SOFTWARE\Wow6432Node\if you can't find the key in the standard path. - Use Event Viewer's online help – Right-click the event and select Event Log Online Help. It might give you a bit more info about the source.
- Trace the provider with WPP – If it's a custom app, the developer might have set up WPP tracing. Check if there's a separate log file that gives more details.
One time, I spent hours on this with a client's backup software. The path was correct, the file existed, but it was the wrong architecture version (32-bit DLL in a 64-bit path). Swapping it out fixed it immediately. So don't skip the architecture check.
If all else fails, you can suppress the error by deleting the provider registration, but only do that if you're certain the app is gone for good. You'll lose event descriptions, but at least the logs will be readable.