|Hello all, I have some wierdness.
using the very simple code below:
EventLog el = new EventLog("Security");
foreach (EventLogEntry elr in el.Entries)
results with the following message:
The description for Event ID '4647' in Source 'Microsoft-Windows-Security-Auditing' cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'S-1-5-21-51003140-4199384537-3980697693-500', 'Administrator', '26L2233A1-06', '0x86377'
As far as I can tell, it's like the .net framework can't find the source dll to resolve the message. I pulled out some old C++ code that did some event log processing and ran it on the same machine and sure enough I couldn't find the message DLL.
I know that Microsoft changed the event log API in vista/2008 but I thought the new API was backwards compatible.
Backwards compatible or not, I need to be able to read the security log on vista/2008.