| Previous | Next |
| ERROR_EVT_FILTER_TOO_COMPLEX | ERROR_EVT_MESSAGE_ID_NOT_FOUND |
ERROR_EVT_MESSAGE_NOT_FOUND
The provider message table lacks the requested message
EvtFormatMessage uses provider metadata as a formatting context and then resolves a resource identifier in the provider message file. This code means the resource itself was found, but its message table does not contain the entry requested by the event or metadata. It differs from publisher metadata not found, where the formatting context cannot be loaded at all.
Compare the provider manifest, event metadata and installed message DLL or executable. A common cause is version skew: newer event definitions reference IDs that an older message resource does not contain. Reinstall the matching binaries rather than copying a single DLL from another system. For archived logs, archive localized resources when exporting if the destination may not have the provider installed.
What to inspect
- Record provider, event ID, version and requested message identifier.
- Verify that manifest and message resource come from the same build.
- Use archived localization for portable EVTX files.
References
Looking for a different code? Search another status or error code.