topic Re:Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event files in Wireless

Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event files

ddbug2 — Tue, 12 Nov 2024 18:44:47 GMT

I am a support engineer and often have to read Windows event logs from PCs of various makes, ages and models, located in many countries.

Always get hard time to grok events of Intel wi-fi adapters, that usually say: "The description for Event ID ... from source Netwtw10 cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer"

When we try to ask Intel wi-fi support what mean all these messages, they usually reply something like "this is OEM device so go bother the OEM and leave us alone'".

Dear wi-fi team! Your event source DLL paths in the registry, under HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\Netwtw...\EventMessageFile are wrong!

The paths there point to system32\drivers - but actually the driver files are under %windir%\System32\DriverStore\FileRepository\netwtwXXX.inf_amd64_XXXX !

Kindly please fix it!

As a quick workaround, copy all these netwtw...sys files from FileRepository\* to %windir%\system32\drivers.

Re:Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event files

Mike_Intel — Thu, 16 Jan 2025 03:35:22 GMT

Hello ddbug2,

Thank you for posting in Intel community Forum.

For me to further check this, please help provide the following details:

What is the complete model of the wireless controller?
Can you further explain why there are wrong registrations in the event logs?
What is the exact fault description encountered with the wireless controller?
Can you also share why you are directed to OEM? There should be some explanation along with that instructions.

If you have questions, please let us know. Thank you.

Best regards,

Michael L.

Intel Customer Support Technician

Re: Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event fil

ddbug2 — Sat, 18 Jan 2025 22:02:29 GMT

Dear Michael thank you for your attention.

This issue indeed seems to exist only for some models but not others. So I apologize for generalization.

The device in question is WIFI 6E AX211 on Dell Latitude 5440; OS: Win11 24H2.

Driver: netwtw6e.inf ; version 23.60.1.2; netwtw14.sys

The adapter itself works well. The problem is only to decode event logs.

So for this specific model, and maybe for more newer models, the default installation directory is Driver Store.

That is, this driver runs directly from the subdirectory of C:\Windows\System32\DriverStore\FileRepository\netwtw6e.inf_amd64...

and not copied into system32\drivers, as it was with all older drivers.

But the event log definition in the registry does not point to the driver store subdirectory. EventMessageFile value is %SystemRoot%\System32\netevent.dll;Netwtw14.sys

In the INF file this place is:

[Reg_CommonAddEventLog_14_WinT] HKR,, EventMessageFile, 0x00020000, "%%SystemRoot%%\System32\netevent.dll;%%13%%\Netwtw14.sys" HKR,, TypesSupported, 0x00010001, 7 [Reg_CommonAddEventLog_14_WinA] HKR,, EventMessageFile, 0x00020000, "%%SystemRoot%%\System32\netevent.dll;%%13%%\Netwaw14.sys" HKR,, TypesSupported, 0x00010001, 7

The dirid 13 means "driver store" - but for some reason this has not been substituted correctly. So the even viewer cannot find the sys file and decode the events.

As a "quick fix" I've changed EventMessageFile to "%SystemRoot%\System32\netevent.dll;%SystemRoot%\System32\drivers\Netwtw14.sys"

and copied Netwtw14.sys to System32\drivers. Then the event viewer finds the driver file and can decode the logs.

On another machine I have older adapter with netwtw08.inf driver (ver. 21.80.60.2), it installs everything to system32\drivers. EventMessageFile is defined as "%SystemRoot%\System32\netevent.dll;%SystemRoot%\System32\drivers\Netwtw08.sys"

so with this one all works as is.

Again thanks for your attention.

ddbug2

Re:Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event files

Mike_Intel — Mon, 20 Jan 2025 01:44:09 GMT

Hello ddbug2,

Thank you for the update.

Since there is no issue with the wireless card/controller. I need to clarify if the end goal of this post/thread.

Are you suggesting that Intel should edit the event logs to show the details that you need?

If yes, please tell us or enumerate the changes that you want so that I will take it as a suggestion and inform the proper team.

If you have questions, please let us know. Thank you.

Best regards,

Michael L.

Intel Customer Support Technician

Re:Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event files

Mike_Intel — Wed, 22 Jan 2025 22:38:32 GMT

Hello ddbug2,

I hope this message finds you well.

Were you able to check the previous post?

Please let us know if you still need assistance.

Best regards,

Michael L.

Intel Customer Support Technician

Re: Re:Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event

ddbug2 — Wed, 22 Jan 2025 23:00:18 GMT

Mike,

Thank you again and apologize for delay.

The suggestion is to inform the owner of the WIFI 6E AX211 Windows driver (folks who maintain the inf files) of the issue and let them sort this out - how to specify the DIRID %13% in the .inf file so that it expands to the actual path after installation and the Windows event viewer can properly display the events.

Otherwise, I have a workaround and am ok for now.

Hopefully we all will see better, quieter, saner times soon,

-- ddbug2

Re:Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event files

Mike_Intel — Fri, 24 Jan 2025 00:20:54 GMT

Hello ddbug2,

Thank you for the update.

Let me clarify, so you have 2 suggestions.

Is to provide the specific issue in the logs right away. And who will sort the issue of found in the logs?
"how to specify the DIRID %13% in the .inf file so that it expands to the actual path after installation and the Windows event viewer can properly display the events." Can you further elaborate this?

Please also understand that logs is just an event viewer. The errors and issues will be logged there however it is up to the end user if he is knowledgeable or he can contact the support team. However, I still want to help you on this suggestion so that I can forward it to the proper team.

If you have questions, please let us know. Thank you.

Best regards,

Michael L.

Intel Customer Support Technician

Re:Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event files

Mike_Intel — Tue, 28 Jan 2025 23:10:13 GMT

Hello ddbug2,

I hope this message finds you well.

I am just making a follow up on the information that I asked.

Please let us know if you still need assistance.

Best regards,

Michael L.

Intel Customer Support Technician

Re: Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event fil

ddbug2 — Tue, 28 Jan 2025 23:21:50 GMT

Hi Michael,

I don't need assistance anymore, thank you.

As for suggestions: just inform the wi-fi support team that their eventlog messages do not render properly, for certain driver (INF) version which refers to DIRID %13%.

Hope they will know what to do.

And hope we'll be ok though the time is, er, hard.

-- ddbug

Re:Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event files

Mike_Intel — Wed, 29 Jan 2025 23:16:22 GMT

Hello ddbug2,

I understand and I will try to forward this feedback.

Since you mentioned that you don't need assistance anymore, I need to close this inquiry.

If you need further assistance, please post a new question as this thread will no longer be monitored.

Thank you and have a great day.

Best regards,

Michael L.

Intel Customer Support Technician

Re: Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event fil

Blocky_Man — Sat, 01 Feb 2025 18:04:57 GMT

Thanks, this problem has been annoying me for a while so while intel hasn't been much help you've solved the problem for me. Many thanks!

Re: Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event fil

HelderMagalhaesSenior — Fri, 25 Jul 2025 10:22:35 GMT

To prevent the drive copying - although with the higher risk of the workaround breaking with updates - I've fixed the driver path by copying the ImagePath from HKLM\SYSTEM\CurrentControlSet\Services\[IDENTIFIER]. So in my case (Netwtw14

Get to the even log configuration for it:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Netwtw14]

EventMessageFile="%SystemRoot%\System32\netevent.dll;%13%\Netwtw14.sys"

Note the bug (%13%) in the path. Then get the identifier (Netwtw14) and fetch it in Services (two levels above). The ImagePath will contain the correct location:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netwtw14]

ImagePath="\SystemRoot\System32\DriverStore\FileRepository\netwtw6e.inf_amd64_e54b51f2feabd3c5\Netwtw14.sys"

Copy the path and paste it after the semi-colon (leaving the netevent.dll and the semi-colon itself). The fixed value will be something like:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Netwtw14]

EventMessageFile="%SystemRoot%\System32\netevent.dll;\SystemRoot\System32\DriverStore\FileRepository\netwtw6e.inf_amd64_e54b51f2feabd3c5\Netwtw14.sys"

As stated above, one may need to repeat the step after a driver update, in case a clean-up of older drivers is performed. On the other hand, this approach seems more "automatable" in a script (only registry manipulation involved).

Hit by this in 2025 (seen it multiple times before, perhaps the wired drivers also had this issue), it's a pity that a clearly reported bug with workaround, albeit perhaps in the best possible channel (what is it?), apparently gets lost in a forum like this (any updates, @Mike_Intel?) while it could be saving thousands of hours of effort to technicians performing log analysis, security forensics, troubleshooting, etc. Thanks @ddbug2!

Re: Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event fil

HelderMagalhaesSenior — Tue, 29 Jul 2025 09:51:43 GMT

Glitch in the solution suggested above: the \SystemRoot only works in the driver realm, it needs to be modified:

Instead of:

~~[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Netwtw14]~~

~~EventMessageFile="%SystemRoot%\System32\netevent.dll;\SystemRoot\System32\DriverStore\FileRepository\netwtw6e.inf_amd64_e54b51f2feabd3c5\Netwtw14.sys"~~

Please use:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Netwtw14]

EventMessageFile="%SystemRoot%\System32\netevent.dll;%SystemRoot%\System32\DriverStore\FileRepository\netwtw6e.inf_amd64_e54b51f2feabd3c5\Netwtw14.sys"