Event Viewer query error message

Usually after an OS upgrade or possibly a major system corruption and repair, event viewer will start throwing up a message when you go into certain “query” views such as the “Custom Views\Administrative Events”. Usually this is because a component that event viewer was configured to monitor no longer exists in the upgraded OS.

One or more logs in the query have errors 
The system cannot find the file specified
The events displayed are partial results

This is usually because an element of the query for the logs is no longer part of the system or is corrupted to the point it can no longer be read.

(If you are seeing this on a standalone Exchange server when opening “Custom Views\Microsoft Exchange with Database Availability Group Events” then check this post instead)

Windows Server upgrade followed by quick and dirty Exchange Repair

NOTE: I am not an Exchange person by any stretch of the imagination, but I do run it at home for all my email as a partial learning exercise, and so get to encounter all sorts of issues I really think I’d rather live without. On that note, this post is here really for my future reference. If anyone else uses this it is at your own risk. Running Exchange 2013 on Windows Server 2012. I wanted to upgrade to Server 2012R2. I was already running Exchange 2013 CU6 so it was supported for 2012R2 at least. There is a *small* note on the Exchange pre-reqs page saying something about upgrading the OS not being supported when Exchange is installed. HA! http://technet.microsoft.com/en-us/library/bb691354(v=exchg.150).aspx#prereq

You can't upgrade Windows when Exchange is installed on the server.

I figured I’d give it a go anyway. I mean, like, what’s the worse that could happen, right? A quick Hyper-V Checkpoint (snapshot) created, checked last nights backups were good and away we go! After the upgrade, the worst happened 😦