• http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
  • http://www.rossi-infotech.com
Home HowTo Exchange - Outlook Two PowerShell Event Logs on Exchange 2007 Server

Contatto

phone  +41 079 487 03 51

fax +41 086 79 487 03 51

mail  7f9c9475b2fb7415fb106b244549df26

con_info 08.30-12.00 / 13.00-17.30

Supporto

Per il scaricare software di gestione remota del vostro PC/Server, cliccate sull'icona, ed eseguite il programma.

troubleshooting

Two PowerShell Event Logs on Exchange 2007 Server

When PowerShell 1.0 is installed an Event Log called "Windows PowerShell" is created.  When Exchange 2007 is then installed, a second Event Log called "PowerShell" is created.  When this log is created, multiple entries are added each time the Exchange Management Shell is opened, so this log rapidly fills up and you will get errors unless you go and change the configuration of the Event Log.  More interestingly, the entries in the "PowerShell" Event Log are unable to be resolved so that the description can be presented.  A typical entry in this log looks like this:

Event Type: Information
Event Source: PowerShell
Event Category: (6)
Event ID: 601
Date:  14.01.2009
Time:  15:01:51
User:  N/A
Computer: SERVERxx
Description:
The description for Event ID ( 601 ) in Source ( PowerShell ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: FileSystem; Stopped;  ProviderName=FileSystem
 NewProviderState=Stopped

 SequenceNumber=5371

 HostName=Default MSH Host
 HostVersion=1.0.0.0
 HostId=06e775be-8xxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxr
 EngineVersion=1.0.0.0
 RunspaceId=xxxxxxxxxxxxxxxxxxxxxxxx-901f-6ccccccccccc
 PipelineId=
 CommandName=
 CommandType=
 ScriptName=
 CommandPath=
 CommandLine=.

To resolve this issue, simply delete the following registry key, which will delete the "PowerShell" Event Log:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\PowerShell

A reboot is required for the change to take effect.  Once the "PowerShell" log is deleted and the server is rebooted, the PowerShell events will flow into the "Windows PowerShell" Event Log without issue, and you will be able to properly view the description of the events.

Note though, that updates or service packs for Exchange may put this Event Log back in, so check for it after any update and simply delete the registry key again if it appears.