Message

PCA was requested to refresh the program cache.

Message

PCA was informed that the program cache was refreshed.

Message

PCA dialog button response %2.

Fields

Message

PCA triggered SIUF question was asked.

Fields

Message

PCA triggered SIUF question was answered.

Fields

Message

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
User action ID: %6
Compatibility layer: %7
FileID: %8
ProgramID: %9

Fields

Message

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.Application name: {ApplicationName}Application version: {ApplicationVersion}Executable path: {ExecutablePath}Scenario ID: {ScenarioId}User action: {UserAction}User action ID: {UserActionID}Compatibility layer: {CompatibilityLayer}Deprecated component: {DeprecatedComponent}FileID: {FileID}ProgramID: {ApplicationName}0

Fields

Message

The Program Compatibility Assistant was invoked due to an unsigned driver install. This version of Windows requires all drivers to have a valid digital signature. Information about the driver is below.Driver: {DriverName}Service: {ServiceName}Publisher: {PublisherName}Location: {DriverPath}Version: {DriverVersion}This driver is unavailable and the program that uses this driver might not work correctly.

Fields

Message

The Program Compatibility Assistant was not invoked because the application has been already handled previously. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
Compatibility layer: %6

Fields

Message

The Program Compatibility Assistant was not invoked as the application executed correctly. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
Compatibility layer: %6

Fields

Message

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenarios code: %4
Deprecated Components: %5
User action ID: %6
Compatibility layers recommended: %7
FileID: %8
ProgramID: %9

Fields

Example Event

system:
  provider: Microsoft-Windows-Application-Experience
  guid: EEF54E71-0661-422D-9A98-82FD4940B820
  event_source_name: ''
  event_id: 201
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2013-10-23T16:24:25.239375Z'
  event_record_id: 380
  correlation: {}
  execution:
    process_id: 892
    thread_id: 3532
  channel: System
  computer: IE8Win7
  security:
    user_id: S-1-5-18
event_data: {}

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Example Event

system:
  provider: Microsoft-Windows-Application-Experience
  guid: EEF54E71-0661-422D-9A98-82FD4940B820
  event_source_name: ''
  event_id: 206
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2013-10-23T22:03:32.528125Z'
  event_record_id: 2787
  correlation: {}
  execution:
    process_id: 808
    thread_id: 2792
  channel: System
  computer: IE8Win7
  security:
    user_id: S-1-5-18
event_data: {}

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application is excluded in the registry.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because of the extension of the executable.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the executable has a UAC manifest.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application has a compatibility fix applied to it.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application depends on the Windows Installer service (MSI).

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the executable has a current SwitchBack context.

Fields

Message

The Program Compatibility Assistant has added %1 to quarantine.

Fields

Message

The Program Compatibility Assistant has removed %1 from quarantine.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the executable has a UAC manifest.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the PCA is disabled by group policy.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application already exists within a job object.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application is a 64-bit application.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application is on a network path.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application compatibility infrastructure is disabled.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application is protected by Windows Resource Protection.

Fields

Message

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application has been excluded from the PCA by Microsoft.

Fields

Message

The Program Compatibility Assistant attempted to connect an event for process ID %1, but the Program Compatibility Assistant service was unable to locate the process.

Fields

Message

Compatibility fix applied to %5.
Fix information: %6, %3, %4.

Fields

Example Event

system:
  provider: Microsoft-Windows-Application-Experience
  guid: EEF54E71-0661-422D-9A98-82FD4940B820
  event_source_name: ''
  event_id: 500
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 576460752303423488
  time_created: '2023-11-06T02:01:06.316061+00:00'
  event_record_id: 268
  correlation: {}
  execution:
    process_id: 10532
    thread_id: 16892
  channel: Microsoft-Windows-Application-Experience/Program-Telemetry
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-21-1992711665-1655669231-58201500-1000
user_data:
  CompatibilityFixEvent:
    ProcessId: 10532
    StartTime: 1699236066.0862
    FixID: AD24F32A-1C4D-4D71-AF4E-1D9031C04F14
    Flags: 65793
    ExePath: C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
    FixName: Apache OpenOffice
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Compatibility fix applied to %5.
Fix information: %6, %3, %4.

Fields

Message

Compatibility fix applied to %7.
Fix information: %8, %3, %4.

Fields

Message

Compatibility fix applied to %7.
Fix information: %8, %3, %4.

Fields

Message

PCA was informed about fix %2 applied to process.

Fields

Message

Compatibility fix applied to %5.
Fix information: %6, %3, %4.

Fields

Example Event

system:
  provider: Microsoft-Windows-Application-Experience
  guid: EEF54E71-0661-422D-9A98-82FD4940B820
  event_source_name: ''
  event_id: 505
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 576460752303423488
  time_created: '2023-11-06T01:51:42.489178+00:00'
  event_record_id: 265
  correlation: {}
  execution:
    process_id: 21364
    thread_id: 8156
  channel: Microsoft-Windows-Application-Experience/Program-Telemetry
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-21-1992711665-1655669231-58201500-1000
user_data:
  CompatibilityFixEvent:
    ProcessId: 21364
    StartTime: 1699235502.3153903
    FixID: 6F36AB95-595F-497D-9001-86DAD299B6FA
    Flags: 2147549701
    ExePath: C:\Program Files\Google\Chrome\Application\chrome.exe
    FixName: AppDefaults
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

An instance of the Steps Recorder ran with the following information:

StartTime: %1
StopTime: %2
Action Count: %3
Missed Action Count: %4
Output file location: %5

Fields

Message

An instance of the Steps Recorder terminated with the following error code: %1

Fields

Message

The Application Impact Telemetry (AIT) Agent terminated with the following error code: %1

Fields

Message

The Application Impact Telemetry (AIT) Agent is not running because AIT is disabled.

Message

The Application Impact Telemetry (AIT) Agent is stopping because another instance is already running.

Message

The Application Impact Telemetry (AIT) Agent was unable to parse the command-line options with error code: %1.

Fields

Message

The Application Impact Telemetry (AIT) Agent was unable to process the logs files with error code: %1.

Fields

Message

The Application Impact Telemetry (AIT) Agent was unable to start application impact SQM with error code: %1.

Fields

Message

The Application Impact Telemetry (AIT) Agent was unable to log application impact data to SQM with error code: %1.

Fields

Message

The Application Impact Telemetry (AIT) Agent was unable to start system telemetry with error code: %1.

Fields

Message

The Application Impact Telemetry (AIT) Agent was unable to log system telemetry data to SQM with error code: %1.

Fields

Message

An instance of Program Data Updater (PDU) ran with the following information: StartTime: {StartTime}; StopTime: {StopTime}; ExitCode: {ExitCode}; Number of new programs: {NumNewPrograms}; Number of removed programs: {NumRemovedPrograms}; Number of updated programs: {NumUpdatedPrograms}; Number of installed programs: {NumInstalledPrograms}; Number of new orphan files: {NumNewOrphans}; Number of new add-ons: {NumNewAddOns}; Number of removed add-ons: {StartTime}0; Number of updated add-ons: {StartTime}1; Number of installed add-ons: {StartTime}2; Number of new installations: {StartTime}3

Fields

Message

An Internet Explorer add-on was installed on the system. For details; please examine the event data.Name: {Name}Type: {Type}Publisher: {Publisher}CLSID: {CLSID}

Fields

Message

An Internet Explorer add-on was updated on the system. For details; please examine the event data.Name: {Name}Type: {Type}Publisher: {Publisher}CLSID: {CLSID}

Fields

Message

An Internet Explorer add-on was removed from the system. For details; please examine the event data.Name: {Name}Type: {Type}Publisher: {Publisher}CLSID: {CLSID}

Fields

Message

A program was installed on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields

Message

A program was installed on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields

Message

A program was updated on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields

Message

A program was updated on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields

Message

A program was removed from the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields

Message

A program was removed from the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields

Message

AMI cache update failure.File path: {FilePath}File ID: {FileID}Program ID: {ProgramID}Error Code: {ErrorCode}

Fields

Fields

Fields

Message

Installer cancel click detected.

Fields

Message

InstallerShield detected.

Fields

Message

File installed.

Fields

Message

New arp key.

Fields

Message

DirectX detection: HighDPIAware.

Fields

Message

DirectX detection: MaximizedWindowedMode.

Fields

Message

DirectX detection: AdaptWindowToDisplayMode.

Fields

Message

The Application Impact Telemetry (AIT) Static Analysis tool ran with the following results:

Start time: %7
Stop time: %8
Runtime: %9
Exit code: %3
Type of analysis: %4
Number of files analyzed: %5
Number of files failed: %6
Analysis command: %10
Program ID: %11

Fields

Message

%1

Fields

Message

The Application Impact Telemetry (AIT) Static Analysis tool ran with the following results:

Start time: %7
Stop time: %8
Runtime: %9
Exit code: %3
Type of analysis: %4
Number of files analyzed: %5
Number of files failed: %6
Analysis command: %10
Program ID: %11

Fields

Message

%3

Fields

Message

The Program Compatibility Troubleshooter was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
Result: %5
Result ID: %6
Compatibility layer: %7
FileID: %8
ProgramID: %9

Fields

Message

The Program Compatibility Troubleshooter queried the Compatibility Online Service for information about an application. Results are below.

Application name: %1
Application version: %2
Executable path: %3
Recommended layer: %4
URL: %5
Compatibility status: %6
FileID: %7
ProgramID: %8

Fields

Message

The Program Compatibility Troubleshooter queried the application genome for information about an application. Results are below.

Application name: %1
Application version: %2
Executable path: %3
Recommended layer: %4
Vista+: %5
FileID: %6
ProgramID: %7

Fields

Message

Program Compatibility Troubleshooter debug event:
%1
%2

Fields

Message

Detector shim: SHORT_RUN_TIME.

Fields

Message

Detector shim: ACCESS_DENIED.

Fields

Message

Detector shim: BLACK_SCREEN.

Fields

Message

Detector shim: WIN32_EXCEPTION: %3.

Fields

Message

Detector shim: GLOBAL_OBJECT.

Fields

Message

Detector shim: PRIVILEGE_CHECK.

Fields

Message

Detector shim: MESSAGE_BOX_VERSION.

Fields

Message

Detector shim: MESSAGE_BOX_PRIVILEGE.

Fields

Message

Detector shim: MESSAGE_BOX_ERROR_ICON.

Fields

Message

Detector shim: REG_EXPAND_SZ.

Fields

Message

Detector shim: DWM_8AND16_MODE.

Fields

Message

Detector shim: KERNEL_DRIVER.

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Message

Message: %1

Fields

Message

Chain: %1, Process: %2, Type: %3
Component: %4
Message: %5

Fields

Message

Message: %1

Fields

Message

Message: %1

Fields