3.2.4.1.2 Retrieving Event Parameter Strings

"ParameterMessageFile" data MAY contain environment variables enclosed in percent characters (%). The client MUST attempt to expand an environment variable as specified in section 3.2.4.1.5.4 to retrieve the full path to the resource file. If the client is accessing a remote source, it MUST then convert the expanded resource file path to a UNC path: when the path begins with an "X:" pattern, where the first character is a drive letter and the second character is ":", the client MUST transform it to \\messageSourceServer\X$\path.

The format of the resource file is specified in [PE-COFF].

When the "ParameterMessageFile" value is present, the client SHOULD attempt to load the resource file<46> by using the SMB Protocol, as specified in [MS-SMB], and retrieve parameter resource strings with ID numbers corresponding to the parameter insertion code encountered during the process of expanding a description string for that source.<47> Parameter insertion rules are further described in 3.2.4.1.5.2.