Event Log Forwarding does not display event message on collector
<p>Yet another Microsoft issue or bug. I just can't seem to get forwarded event logs show the Message of the event. I always get the following in the details section:</p>

<pre><code>The description for Event ID xxx from source AD FS Auditing cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.
</code></pre>

<p>This only happens on "non standard" events from another application (ADFS in my case).</p>

<p>Some of the action items I have done:</p>

<ol>
<li><p>Made sure subscription is in Rendered Text: <strong>wecutil ss "Subscription Name" /cf:RenderedText</strong></p></li>
<li><p>Copied all DLLS from source servers application (ADFS) and placed it in the collector server in the same path</p></li>
<li><p>Created a registry key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Forwarded Events (Note I cannot create a new event log that is an accepted destination in creating the subscription, another Windows limitation). </p></li>
<li><p>Added registry keys for each Source/Providers and registry values for EventMessageFile pointing to the DLLs</p></li>
</ol>

<p>I also tried converting from <strong>RenderedText</strong> back to <strong>Events</strong> in case the above steps fixed it, but it did not.</p>

<p>Can anyone identify what's happening? I just don't understand why Event Log does not just forward the message text like syslog; this all seems like unnecessary complication.</p>