How can I use the /auxsource flag in Event Viewer on Windows XP and later?

A. When you open an event-log file, you must tell Event Viewer the type of log to use (e.g., Application, Security, System). The computer hosting the event-log file generates this list of options.

Problems can occur if you're not in the Administrator group of the machine hosting the event file or if the Remote Registry service is disabled on the host computer. If either of these conditions are true, the event descriptions might not be available, which leaves you with a fairly useless event log.

You can use the mmc.exe command to open a Microsoft Management Console (MMC) console and specify the /auxsource flag to tell Event Viewer to use an alternate source for the descriptions. For the best results, the alternate source should be as similar to the computer that generated the event file to ensure the same components are available to provide full event descriptions.

To run the mmc.exe command, open the Run dialog box or go to the command prompt and type

mmc /a eventvwr.msc /auxsource=

Some event logs won't work from a remote computer. For example, to read Active Directory (AD) logs, you must be running Event Viewer on a domain controller (DC), even if you use the /auxsource switch. The same is true for the DNS and File Replication Service (FRS) logs.