Ryfujk

Many of the event descriptions for event log events are missing when I query them in powershell with Get-EventLog but they are present when I query them in powershell with Get-WinEvent or view them in the regular event viewer eventvwr.msc

Here's the output of Get-EventLog:

PS U:> Get-EventLog -LogName System -Source Microsoft-Windows-Kernel-Power



   Index Time          EntryType   Source                 InstanceID Message

   ----- ----          ---------   ------                 ---------- -------

   11985 Apr 02 13:42  Information Microsoft-Windows...          172 The description for Event ID '172' in Source 'Microsoft-Windo...

   11968 Apr 02 13:41  Information Microsoft-Windows...          109 The description for Event ID '109' in Source 'Microsoft-Windo...

   11732 Apr 02 09:41  Information Microsoft-Windows...          172 The description for Event ID '172' in Source 'Microsoft-Windo...

   11714 Apr 02 09:40  Information Microsoft-Windows...          109 The description for Event ID '109' in Source 'Microsoft-Windo...

   10363 Mar 29 14:28  Information Microsoft-Windows...          172 The description for Event ID '172' in Source 'Microsoft-Windo...

   10346 Mar 29 14:28  Information Microsoft-Windows...          109 The description for Event ID '109' in Source 'Microsoft-Windo...

Here's a full event:

PS U:> Get-EventLog -LogName System -Source Microsoft-Windows-Kernel-Power | select -first 1 | fl





Index              : 11985

EntryType          : Information

InstanceId         : 172

Message            : The description for Event ID '172' in Source 'Microsoft-Windows-Kernel-Power' cannot be found.  The local

                     computer may not have the necessary registry information or message DLL files to display the message, or you

                     may not have permission to access them.  The following information is part of the event:'2', '6'

Category           : (203)

CategoryNumber     : 203

ReplacementStrings : {2, 6}

Source             : Microsoft-Windows-Kernel-Power

TimeGenerated      : 2019-04-02 13:42:01

TimeWritten        : 2019-04-02 13:42:01

UserName           : NT AUTHORITYSYSTEM

Here's the output from Get-WinEvent:

PS C:WINDOWSsystem32> Get-WinEvent -LogName System -FilterXPath "<QueryList>

>>   <Query Id='0' Path='System'>

>>     <Select Path='System'>*[System[Provider[@Name='Microsoft-Windows-Kernel-Power']]]</Select>

>>   </Query>

>> </QueryList>"





   ProviderName: Microsoft-Windows-Kernel-Power



TimeCreated                     Id LevelDisplayName Message

-----------                     -- ---------------- -------

2019-04-02 13:42:01            172 Information      Connectivity state in standby: Disconnected, Reason: NIC compliance

2019-04-02 13:41:44            109 Information      The kernel power manager has initiated a shutdown transition....

2019-04-02 09:41:08            172 Information      Connectivity state in standby: Disconnected, Reason: NIC compliance

2019-04-02 09:40:51            109 Information      The kernel power manager has initiated a shutdown transition....

2019-03-29 14:28:26            172 Information      Connectivity state in standby: Disconnected, Reason: NIC compliance

2019-03-29 14:28:09            109 Information      The kernel power manager has initiated a shutdown transition....

Get-WinEvent is able to render the message "Connectivity state in standby: Disconnected, Reason: NIC compliance" with no problems.

Here's the first event in event viewer with the message displayed properly as well:

The message suggests that the registry or event message dll file might be a problem but I've checked and they aren't:

PS U:> Get-ItemPropertyValue HKLM:SYSTEMCurrentControlSetServicesEventLogSystemMicrosoft-Windows-Kernel-Power -name EventMessageFile

C:WINDOWSsystem32microsoft-windows-kernel-power-events.dll

PS U:> test-path C:WINDOWSsystem32microsoft-windows-kernel-power-events.dll

True

PS U:> $handle = [System.IO.File]::OpenRead("C:WINDOWSsystem32microsoft-windows-kernel-power-events.dll")

PS U:> $handle.CanRead

True

This shows that

1. The source is configured in the registry


2. The file exists


3. I can read the file

This is not isolated to the Microsoft-Windows-Kernel-Power source. The same happens for lots of other event sources. But not all event sources. For example Get-EventLog renders the Microsoft-Windows-Winlogon source messages properly:

PS U:> Get-EventLog -LogName System -Source Microsoft-Windows-Winlogon | select -first 1 | ft



   Index Time          EntryType   Source                 InstanceID Message

   ----- ----          ---------   ------                 ---------- -------

   12100 Apr 02 13:58  Information Microsoft-Windows...         7001 User Logon Notification for Customer Experience Improvement P...

I've already restarted my machine multiple times and I ran the System File Checker and it reported no problems.

Version details:

PS U:> $PSVersionTable



Name                           Value

----                           -----

PSVersion                      5.1.17763.316

PSEdition                      Desktop

PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}

BuildVersion                   10.0.17763.316

CLRVersion                     4.0.30319.42000

WSManStackVersion              3.0

PSRemotingProtocolVersion      2.3

SerializationVersion           1.1.0.1