Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I enabled auditing on a folder on a machine running Windows XP Embedded. Trying to read the security log (or any log for that matter), I get the following description for most events:

The description for Event ID ( 560 ) in Source ( Security ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details.

What I don't understand is why it refers to a remote computer in this case? The computer is not connected to a network, is not part of a domain and all I want to do is read local logs.

I looked through the following knowledge base article: http://support.microsoft.com/kb/312216

But reading the following part confused me since I am only interested in local events and there is no server/domain/network in the picture: The list of event log types is read from the computer that is hosting the .evt file and that is on a network share.

At the end of the event description for a particular event, the following was shown:

The following information is part of the event: Security; File; C:\App\db\local.db; 2300; 0; 343284; 2428; C:\App\Test1.exe; maintainer; OEM-98YL6YOBWAK; (0x0,0xDA85); -; -; -; %%1538 %%1541 %%4416 %%4417 %%4418 %%4419 %%4420 %%4423 %%4424 ; -; 0.

Can someone point me to a description of how to interpret each part of this type of event?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.