detection.wiki

Microsoft-Windows-AppReadiness › Event 10

Event ID 10 — The Appx operation 'Operation' on 'PackageId' failed for user 'User' - Error.

Provider
Microsoft-Windows-AppReadiness
Channel
Admin
Level
Error
Task
AppReadiness_Error

Description

The Appx operation 'Operation' on 'PackageId' failed for user 'User' - Error. (Error: Result).

Message #

The Appx operation '%2' on '%3' failed for user '%1' - %5. (Error: %4)

Fields #

NameDescription
User UnicodeString—
Operation UnicodeString—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
PackageId UnicodeString—
Result Int325. (Error.
Error UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "F0BE35F8-237B-4814-86B5-ADE51192E503",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 2,
    "task": 6,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2023-11-05T22:29:17.204020+00:00",
    "event_record_id": 445,
    "correlation": {
      "ActivityID": "59A0D65F-1037-0001-E4F0-A0593710DA01"
    },
    "execution": {
      "process_id": 5660,
      "thread_id": 5712
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1992711665-1655669231-58201500-1000",
    "Operation": "RegisterPackageAsync",
    "PackageId": "Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe",
    "Result": -2147009274,
    "Error": "Windows cannot install package Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe because it has version 14.0.30704.0. A higher version 14.0.32530.0 of this package is already installed."
  },
  "message": ""
}

References #