Fix 0x3AB9: Event Log Locale Missing Error

Quick answer (for advanced users)

Run wevtutil el | findstr /i "your_event_source" to find the provider, then wevtutil gp <provider> /ge /gm /lf:en-US to reset locale mapping. If that fails, re-register the source DLL with regsvr32 <path_to_msg_dll>.

What's actually happening here

This error shows up in the Windows Event Viewer when you click on a log entry and get that numeric error instead of a human-readable message. The event itself fired fine — the system logged it correctly — but the local event viewer can't find the msg file (the .dll or .exe that holds the language-specific strings) for that event source.

Windows stores event messages in separate binary files per language. For example, a program called MyApp.exe might have MyApp.exe.mui in the en-US folder under its install directory. If that .mui file is missing, corrupted, or the registry path points to the wrong location, you get error 0x00003AB9.

I've seen this most often after:

Installing a language pack and then uninstalling it
Copying an application from one machine to another without its language resources
Running a system cleaner (like CCleaner) that removed .mui files thinking they were junk
Windows Update that replaced a system DLL but didn't update the locale mapping

Step-by-step fix

Identify the event source — Open Event Viewer, double-click the error entry, look at the Source field in the General tab. Write it down exactly (case-sensitive).
Find the provider's message file — Open Command Prompt as admin, type:
```
wevtutil gp <SourceName> /ms
```
This shows the messageFileName path. If it's blank or points to a file that doesn't exist, that's your problem.
Fix the registry mapping — Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\<SourceName>. Look for a REG_SZ value called EventMessageFile. If it's missing or wrong, set it to the full path of the correct .dll/.exe (like C:\Program Files\MyApp\MyApp.exe).
Re-register the DLL — If the file exists but the error persists, run:
```
regsvr32 "C:\path\to\event\source.dll"
```
The reason step 3 works is that Windows reads EventMessageFile to find the binary that contains the message strings. If the DLL is registered but the registry path is stale, it won't load.
Refresh the event log — Restart the Windows Event Log service (net stop EventLog && net start EventLog) or reboot. Then check the same event again.

Alternative fixes if the main one fails

Install the missing MUI language pack — Go to Settings > Time & Language > Language, add the missing language (e.g., English if you use en-US). Windows will download the .mui files. This fixes system-level events.
Use a tool like Process Monitor — Filter for the event source name and look for NAME NOT FOUND results on .mui files. This tells you exactly which file is missing.
Repair the application — If it's a third-party program (like an antivirus or driver), run its installer's repair option. That usually re-deploys the message files.
Last resort: disable the event source — If the app is unused, delete the registry key for it under EventLog\Application\<SourceName>. The error goes away but you lose all logging from that source.

Prevention tip

Never delete files from C:\Windows\System32\en-US or any xx-XX folder. Those are system language resources. If you must clean disk space, use the built-in Disk Cleanup tool — don't use third-party cleaners that claim to remove 'unnecessary' language files. They often break the event log for multiple sources at once.

Also, when moving a portable app to a new machine, copy the entire program folder including any .mui subdirectories. Skipping them is what triggers this error later.