Event ID 1903 from source HHCTRL cannot be found

I am getting a new edition of this every 5 minutes in Event Viewer-Windows-Applications since downloading the final version of Windows 8.1. Is there a way to stop these messages from being added and wasting hard drive space? I don’t have a clue what they mean except it is obvious that Windows 8.1 Final Version should not be final. IT STILL HAS BUGS! When I looked at Event Viewer-Windows-Applications this AM, there were more than 1400 entries and most of them were repeats of the subject.

Any help shall be appreciated and thanks in advance.

ps: I picked Repair and Recovery below because none of the choices seems to match the problem.

Replies (9) 

HHCTRL is Microsoft HTML Help Control center.

Are you facing any issues with Windows performance?

To understand the issue better, I would suggest you to post the event viewer detailed information. However, you may check if you face the same issue in safe mode wherein the computer starts with basic drivers and no third party programs.

If the issue doesn’t occur in Safe mode, you may try to restart the computer in clean boot mode to check if any third party application is causing the issue, as clean boot helps in eliminating software conflicts. The steps given in the article are similar to Windows 8.1 operating system.

Note : After troubleshooting, see the section “How to reset the computer to start as usual after troubleshooting with clean boot” to return the computer to a Normal startup mode.

I would also suggest you to provide a screenshot of the error details to assist you better:

How to include a screenshot in your post

Let us know the results. If you have any further issues on the computer, please post your question regarding Windows and we will be happy to help you.

Source microsoft windows was cannot be found

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Answered by:

Question

Today I carried out a simple shutdown on a vm,

when I went to start it backup it said «merge in progress» I assume I must of deleted a snapshot several weeks ago.

Once I restarted it

Great, looking at the logs:

The description for Event ID 3030 from source Microsoft-Windows-Hyper-V-Worker cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

The locale specific resource for the desired message is not present

So, Looking in the hyper v server folder, I have ive got the following files

but wait, I dont have any snap shots. and it said it had merged?

I’ve tried reattaching the disk to a new vm but I get the same message.

I’ve also powered down another vm, and this is having the same issue (this had no snapshots). WTF??

I can build new VMs fine.

Unfortunately I dont want to reboot the server as it may screw up my remaining vms that are up and running.

[RESOLVED] DISM «error 0x800f081f The source files could not be found» even with correct ISO and path

This has been resolved, see solution below.

I resolved this by downloading the Windows 10 ISO from the Microsoft Tech Bench Upgrade Program and using that as the source for the DISM command — see my post further below.
I’m unable to mark this as the answer because I was also the Original Poster but it solved my issues.

I can’t seem to run SFC or DISM to repair the computer, althought I’ve tried quite a few avenues to fix it already (see below).

Note: All commands are being performed as administrator.

The PC has a clean installl (reformatted and installed post upgrade from Win8.1) of Windows 10 (version 1511, build 10586.104). It has recently started having some problems and blue screens (not virus or malware related).

When I run sfc /scannow (as admin) the corruptions cannot be repaired.

Dism /Online /Cleanup-Image /RestoreHealth

But get following error:

The source files could not be found.

Ran Dism /Online /Cleanup-Image /CheckHealth and get following result:

Deployment Image Servicing and Management tool
Version: 10.0.10586.0

Image Version: 10.0.10586.0

The component store is repairable.
The operation completed successfully.

Downloaded Windows 10 ISO (using Media Creation tool) and mounted it (to E:\) then tried to run:

Dism /Online /Cleanup-Image /RestoreHealth /Source:wim: E:\Sources\Install.wim :1 /limitaccess

But get the same error:

The source files could not be found.

Attached the USB key (that was used for the install) with Windows 10 on it (connected as I:\) and tried to run:

Dism /Online /Cleanup-Image /RestoreHealth /Source:esd: I:\Sources\Install.esd :1 /limitaccess

But get the same error:

The source files could not be found.

I also mounted the original ISO that I downloaded (sometime late last year) and tried using that as the source but also got the same error.

I followed the advice of some other posts to launch the Windows 10 installer and «refresh» (aka reinstall or upgrade) Windows 10 (choosing the option to keep all existing files and apps). But even after completing the refresh process, I get the same errors trying to run SFC or DISM commands.

I have also tried resetting the windows update components using the following:

net stop wuauserv
cd %systemroot%\SoftwareDistribution
ren Download Download.old
net start wuauserv
net stop bits
net start bits
net stop cryptsvc cd %systemroot%\system32
ren catroot2 catroot2.old
net start cryptsvc

Then tried running the DISM again, but still get the same error as above.

Am running a relatively new Samsung 850 Pro SSD (with latest firmware) with 15% overprovisioning. I decided to run chkdsk just to be sure and there are no errors.

Tried DISM and SFC again but same errors witth those.

Have read a bunch of threads, MS KB articles and MS Support articles and none of it has helped. I see a LOT of people with similar problems. This is ridiculously bad and wasting a lot of time for a lot of people. Microsoft need to resolve this problem.

And I’d really like some help to get a solution for my issue now as no matter what I do, I can’t seem to get this repaired.

Description for event id from source cannot be found

When I write a log into windows event log, I get the event below, what’s the root cause of this message, and how can I fix it? Many Thanks

The description for Event ID 51001 from source RRWS cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

test log messge

the message resource is present but the message is not found in the string/message table

11 Answers 11

I got this error after creating an event source under the Application Log from the command line using «EventCreate». This command creates a new key under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application

If you look at the Key that’s been created (e.g. SourceTest) there will be a string value called EventMessageFile , which for me was set to %SystemRoot%\System32\EventCreate.exe .

Change this to c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll

Delete the CustomSource and TypesSupported values.

This should stop the «The description for Event ID. » message.

How about a real world solution.

If all you need is a «quick and dirty» way to write something to the event log without registering «custom sources» (requires admin rights), or providing «message files» (requires work and headache) just do this:

This way you’ll be writing to an existing «Application» log without the annoying «The description for Event ID 0 cannot be found»

If you want the «magic» part explained I blogged about it here

Restart your system!

A friend of mine had exactly the same problem. He tried all the described options but nothing seemed to work. After many studies, also of Microsoft’s description, he concluded to restart the system. It worked!!

It seems that the operating system does not in all cases refresh the list of registered event sources. Only after a restart you can be sure the event sources are registered properly.

You need to create an event source and a message file for it. Code looks something like this:

Then you will need to create a message file. There is also this article that explains things (I did not read it all but it seems fairly complete).

Use PowerShell to create your event log and source:

You’ll need the messages dll to avoid the problem you are seeing.

I also faced similar problem. After doing lot of research I did following I verified the steps according to this article http://www.codeproject.com/Articles/4166/Using-MC-exe-message-resources-and-the-NT-event-lo Everything seemed to be in place. Except one thing..i realised it when I stumbled on this msdn http://msdn.microsoft.com/en-us/library/windows/desktop/aa363661(v=vs.85).aspx

As last paragraph says.. ‘If the application calls RegisterEventSource and passes a source name that cannot be found in the registry, the event-logging service uses the Application log by default. However, because there are no message files, the Event Viewer cannot map any event identifiers or event categories to a description string, and will display an error. For this reason, you should add a unique event source to the registry for your application and specify a message file.’ So my application name in RegisterEventSource was not matching with the application name in registry. I fixed this and now it works. So please double check your registry entries if you face this problem.

I also stumbled on this — although caused by yet another possibility: the event identifier (which was «obfuscated» in a #define ) was setting severity to error (the two high-order bits as stated in Event Identifiers). As Event Viewer displays the event identifier (the low-order 16 bits), there couldn’t be a match.

For reference, I’ve put together a set of tips based in my own research while troubleshooting and fixing this:

If your log entry doesn’t end with «the message resource is present but the message is not found in the string/message table» (as opposed to the original question):

• Means that you’re missing registry information
• Double-check event source name and registry keys

If you need to add/edit registry information, remember to:

• Restart Event Viewer (as stated in item 6 of KB166902 and also by @JotaBe)
• If it doesn’t help, restart Windows Event Log/ EventLog service (or restart the system, as hinted by @BrunoBieri).

If you don’t wish to create a custom DLL resource, mind that commonly available event message files have some caveats:

• They hold a large array of identifiers which attempts to cover most cases
  • .NET EventLogMessages.dll (as hinted by @Matt) goes up to 0xFFFF
  • Windows EventCreate.exe «only» goes up to 0x3E9
• Every entry contains %1
  • That means that only the first string will be displayed
  • All strings passed to ReportEvent can still be inspected by looking into event details (select the desired event, go to Details tab and expand EventData)

If you’re still getting «cannot be found» in your logged events (original question):

• Double-check event identifier values being used (in my case it was the Qualifiers part of the event identifier)
• Compare event details (select the desired event, go to Details tab and expand System) with a working example

Source microsoft windows was cannot be found

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Answered by:

Question

I have source initiated subscription method of Event Log Forwarding. It is working, however, in it’s Forwarded Events log, the collector is showing many of this message: «The description for Event ID 111 from source Microsoft-Windows-EventForwarder cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event.»

I find little or nothing about this error on the Internet, especially in regard to Event log forwarding. My literal understanding of this message (which may be wrong) would lead me to think that if a source server had for example, IIS, but my Collector didn’t, it wouldn’t be able to display an IIS forwarded event? If that’s the case, it would be a totally asinine design! We do not want to install every Role or Feature of Windows Server 2008 that every Source computer has, onto the Collector, just to display events. Hopefully I’m wrong and someone will educate me.

Answers

Can you make sure ‘Network Service’ is member of «Event Log Readers» group?

Also, check below document if they are of any helP:

Ketan Thakkar | Microsoft Online Community Support

All replies

Thank you for your post.

No need to install IIS on collector if source server forward IIS event log.

The event 111 just show some eventforwarder failed and you need to check EventLog-ForwardPlugin/Operational log for the error details like this sample.

Regards,
Rick Tan

Sorry, I don’t see how that site is helpful. all they’re doing is listing a couple possible errors you may run into, one of which is my event 111 error. And I posted the error details above in my first post. I don’t see this log that’s mentioned (ForwardPlugin/Operational) on either my Collector server, nor on that website. I had followed all the steps in this article: http://msdn.microsoft.com/en-us/library/windows/desktop/bb870973(v=vs.85).aspx with the exception of we didn’t do the winrm qc -q, since our firewalls are turned off until we finish configuring them (and no, at this point we can NOT turn them on just to run this) and instead we went to each machine (including collector) and did the following (which I’d read—except for the GPO part—is all that the quickconfig does anyways):

1. Made sure WinRM service is running on all servers and is set to Automatic-Delayed start.
2. Enable Rule on Firewall for Win RM (5985) — even though, as I understand it’s not needed now (but will be when we finally turn on our firewalls.)
3. Add the collector server to Event Log Readers on all «Source» servers that forward to it.
4. Created a GPO in OU=servers (beneath which all our servers are located except D.C.’s), which has the following:

• Computer Config, Windows Components, Event Forwarding (enable it, enter in Subscription Managers your collector server (Server=http://Myservername(fqdn):5985/wsman/SubscriptionManager/WEC
• Computer Config, Windows Components,Windows Remote Management, WinrM Service, Allow Automatic Configuration of Listeners, IPv4 filter = (here i input all IP Rranges that our servers use)
• Ran gpupdate /force on all Source servers to pull down this policy. A «winrm e winrm/config/listener» shows a listener configured on each server after applying the GPO.

The same steps were followed on the collector server, except I had excluded it from the above GPO applying, and instead had run «winrm create winrm/config/listener?Address=*+Transport=HTTP» manually on it.

Of course I setup subscriptions on the collector, set it for last 7 days, one each for App, Security, System logs, to show Critical, Warnings, and Error events, and added each source server into each one’s properties.

I determined after reading various Microsoft and other articles online, that your collector server does NOT have to be a domain controller, so ours is not. I also did not run «wecutil» as some articles mention, since I’d read that’s only needed if doing Collector-initiated subscriptions which I didn’t do since MS says source-initiated is the preferred method, and also since I’d read it requires creating some long xml code file. (although I did notice that in step 1 above, that command happens to say WEC in it, but maybe that’s not pertinent) I’d read some statements on (only some sites) about local loopback IP should be in your IPv4 Filter, but other articles don’t mention it.

I don’t know much about how this listener works—if I did I’d fix it myself. If anyone needs me to post any other info, let me know please. (I’ll just have to hide our servernames/ip’s as that’s confidential) Also, all our servers are 2008 R2 64bit (except one 32bit source server but this is not the collector.)

The funny thing is for one server, for example, I get CAPI2 (event 4107) errors being forwarded, but anything else from it are the event id 111 (can’t find description) errors. Same thing for our Exchange server, it will forward event 9823 errors but all others are 111.