I enabled auditing on a folder on a machine running Windows XP Embedded. Trying to read the security log (or any log for that matter), I get the following description for most events:
The description for Event ID ( 560 ) in Source ( Security ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details.
What I don't understand is why it refers to a remote computer in this case? The computer is not connected to a network, is not part of a domain and all I want to do is read local logs.
I looked through the following knowledge base article: http://support.microsoft.com/kb/312216
But reading the following part confused me since I am only interested in local events and there is no server/domain/network in the picture: The list of event log types is read from the computer that is hosting the .evt file and that is on a network share.
At the end of the event description for a particular event, the following was shown:
The following information is part of the event: Security; File; C:\App\db\local.db; 2300; 0; 343284; 2428; C:\App\Test1.exe; maintainer; OEM-98YL6YOBWAK; (0x0,0xDA85); -; -; -; %%1538 %%1541 %%4416 %%4417 %%4418 %%4419 %%4420 %%4423 %%4424 ; -; 0.
Can someone point me to a description of how to interpret each part of this type of event?