Microsoft-Windows-AppXDeployment

93 events across 2 channels

Event ID	Title	Channel
301	The calling process is {FileName}.	Operational
302	Failed to start system service: %1 with error: %2.	Operational
303	Failed to start system service: %1 with error: %2.	Operational
304	Starting recovery of package repository during a %1.	Operational
305	Finished recovery of package repository with result code %1.	Operational
306	Skipping recovery of package %1 because it is already installed.	Operational
307	Recovery has completed for package %2 with result code %1.	Operational
308	Starting staged package recovery.	Operational
309	Finished staged package recovery with result code %1.	Operational
310	Skipping recovery of package %1 because of error %2.	Operational
311	Failed to bind to the APPXSVC RPC server with error.	Operational
312	%2: Package runtime information %1 is corrupted (address=%5, size=%3, offset=%4, …	Operational
313	%2: Package runtime information %1 is missing expected data (address=%4, …	Operational
314	%2: Package runtime information %1 contains conflicting data (address=%5, …	Operational
315	%2: Package runtime information %1 contains unexpected data (address=%5, …	Operational
316	%2: Package runtime information %1 failed to load (processid=%3).	Operational
317	Package runtime information %1 failed to load because exception %2 occurred.	Operational
318	%2: Package runtime information %1 is missing expected data (address=%4, …	Operational
319	%2: Application identity not accessible while loading package runtime …	Operational
320	Failed to queue removal of package %1 for user %2 with error: %3.	Operational
321	Failed to remove the package files of package %1 with error: %2.	Operational
322	Failed to set the package status of package %1 with error: %2.	Operational
323	Failed to remove {PackageName} for the user ({UserSid}) with error: {ErrorCode}.	Operational
324	Package runtime information %1 failed to refresh because the following error %2 …	Operational
325	%1 is registered in good state, skip re-registering it.	Operational
326	Determining packages to be installed during logon for user.	Operational
327	The following packages will be installed.	Operational
328	Unable to determine packages to be installed during logon with error.	Operational
329	User Profile created for %1 with path %2 and type %3.	Operational
330	User Profile deleted for %1 with path %2 and type %3.	Operational
331	Outdated packages registered to user %1: %2.	Operational
332	Deployment operation %2 on %1 with options %3 and calling process %4 with …	Operational
1001		Diagnostic
1002		Diagnostic
1003		Diagnostic
1004		Diagnostic
1005		Diagnostic
1006		Diagnostic
1007		Diagnostic
1008		Diagnostic
1009		Diagnostic
1010		Diagnostic
1011		Diagnostic
1012		Diagnostic
1013		Diagnostic
1014		Diagnostic
1015		Diagnostic
1016		Diagnostic
1017		Diagnostic
1018		Diagnostic
1019		Diagnostic
1020		Diagnostic
1021		Diagnostic
1022		Diagnostic
1023		Diagnostic
1024		Diagnostic
1025		Diagnostic
1026		Diagnostic
1027		Diagnostic
1028		Diagnostic
1029		Diagnostic
1030		Diagnostic
1031		Diagnostic
1032		Diagnostic
1033		Diagnostic
1034		Diagnostic
1035		Diagnostic
1036		Diagnostic
1037		Diagnostic
1038		Diagnostic
1039		Diagnostic
1040		Diagnostic
1041		Diagnostic
1042		Diagnostic
1043		Diagnostic
1044		Diagnostic
1045		Diagnostic
1046		Diagnostic
1047		Diagnostic
1048		Diagnostic
1049		Diagnostic
1050		Diagnostic
1051		Diagnostic
1052		Diagnostic
1053		Diagnostic
1054		Diagnostic
1055		Diagnostic
1056		Diagnostic
1057		Diagnostic
1058		Diagnostic
1059		Diagnostic
1060		Diagnostic
1061		Diagnostic

Event ID 301 — The calling process is {FileName}.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

The calling process is {FileName}

Fields

Name	Description
`FileName`	—

Event ID 302 — Failed to start system service: %1 with error: %2.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational
Level: 2
Samples: 1

Message

Failed to start system service: %1 with error: %2.

Fields

Name	Description
`ServiceName`	Failed to start system service.
`ErrorCode`	with error.

Example Event

system:
  provider: Microsoft-Windows-AppXDeployment
  guid: 8127F6D4-59F9-4ABF-8952-3E3A02073D5F
  event_source_name: ''
  event_id: 302
  version: 0
  level: 2
  task: 4
  opcode: 0
  keywords: 4611756387171631104
  time_created: '2022-04-07T16:45:08.860422+00:00'
  event_record_id: 2
  correlation:
    ActivityID: C1DC836A-4A9E-0000-538F-DCC19E4AD801
  execution:
    process_id: 3864
    thread_id: 3868
  channel: Microsoft-Windows-AppXDeployment/Operational
  computer: WIN-FPV0DSIC9O6
  security:
    user_id: S-1-5-18
event_data:
  ServiceName: appxsvc
  ErrorCode: '0x8007045b'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 303 — Failed to start system service: %1 with error: %2.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Failed to start system service: %1 with error: %2.

Fields

Name	Description
`ServiceName`	—
`ErrorCode`	—

Event ID 304 — Starting recovery of package repository during a %1.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Starting recovery of package repository during a %1.

Fields

Name	Description
`RecoveryType`	—

Event ID 305 — Finished recovery of package repository with result code %1.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Finished recovery of package repository with result code %1.

Fields

Name	Description
`ErrorCode`	—

Event ID 306 — Skipping recovery of package %1 because it is already installed.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Skipping recovery of package %1 because it is already installed.

Fields

Name	Description
`PackageFullName`	—

Event ID 307 — Recovery has completed for package %2 with result code %1.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Recovery has completed for package %2 with result code %1.

Fields

Name	Description
`ErrorCode`	—
`PackageFullName`	—

Event ID 308 — Starting staged package recovery.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Starting staged package recovery.

Event ID 309 — Finished staged package recovery with result code %1.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Finished staged package recovery with result code %1.

Fields

Name	Description
`ErrorCode`	—

Event ID 310 — Skipping recovery of package %1 because of error %2.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Skipping recovery of package %1 because of error %2.

Fields

Name	Description
`PackageFullName`	—
`ErrorCode`	—

Event ID 311 — Failed to bind to the APPXSVC RPC server with error.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Failed to bind to the APPXSVC RPC server with error: %1.

Fields

Name	Description
`ErrorCode`	—

Event ID 312 — %2: Package runtime information %1 is corrupted (address=%5, size=%3, offset=%4, section=%6, processid=%7).

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

%2: Package runtime information %1 is corrupted (address=%5, size=%3, offset=%4, section=%6, processid=%7). Reinstall the package to fix this issue.

Fields

Name	Description
`FileName`	—
`ErrorCode`	—
`Size`	—
`Offset`	—
`HeaderAddr`	—
`Section`	—
`ProcessId`	—

Event ID 313 — %2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6).

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

%2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6). Reinstall the package to fix this issue.

Fields

Name	Description
`FileName`	—
`ErrorCode`	—
`Size`	—
`HeaderAddr`	—
`Section`	—
`ProcessId`	—

Event ID 314 — %2: Package runtime information %1 contains conflicting data (address=%5, size=%3, offset=%4, section=%6, processid=%7).

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

%2: Package runtime information %1 contains conflicting data (address=%5, size=%3, offset=%4, section=%6, processid=%7). Reinstall the package to fix this issue.

Fields

Name	Description
`FileName`	—
`ErrorCode`	—
`Size`	—
`Offset`	—
`HeaderAddr`	—
`Section`	—
`ProcessId`	—

Event ID 315 — %2: Package runtime information %1 contains unexpected data (address=%5, size=%3, offset=%4, section=%6, processid=%7).

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

%2: Package runtime information %1 contains unexpected data (address=%5, size=%3, offset=%4, section=%6, processid=%7). Reinstall the package to fix this issue.

Fields

Name	Description
`FileName`	—
`ErrorCode`	—
`Size`	—
`Offset`	—
`HeaderAddr`	—
`Section`	—
`ProcessId`	—

Event ID 316 — %2: Package runtime information %1 failed to load (processid=%3).

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

%2: Package runtime information %1 failed to load (processid=%3).

Fields

Name	Description
`FileName`	—
`ErrorCode`	—
`ProcessId`	—

Event ID 317 — Package runtime information %1 failed to load because exception %2 occurred.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Package runtime information %1 failed to load because exception %2 occurred.

Fields

Name	Description
`FileName`	—
`ExceptionCode`	—

Event ID 318 — %2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6).

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

%2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6). Reinstall the package to fix this issue.

Fields

Name	Description
`FileName`	—
`ErrorCode`	—
`Size`	—
`HeaderAddr`	—
`ApplicationUserModelId`	—
`ProcessId`	—

Event ID 319 — %2: Application identity not accessible while loading package runtime information %1 (address=%4, size=%3, processid=%5).

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

%2: Application identity not accessible while loading package runtime information %1 (address=%4, size=%3, processid=%5).

Fields

Name	Description
`FileName`	—
`ErrorCode`	—
`Size`	—
`HeaderAddr`	—
`ProcessId`	—

Event ID 320 — Failed to queue removal of package %1 for user %2 with error: %3.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Failed to queue removal of package %1 for user %2 with error: %3.

Fields

Name	Description
`PackageName`	—
`UserSid`	—
`ErrorCode`	—

Event ID 321 — Failed to remove the package files of package %1 with error: %2.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Failed to remove the package files of package %1 with error: %2.

Fields

Name	Description
`PackageName`	—
`ErrorCode`	—

Event ID 322 — Failed to set the package status of package %1 with error: %2.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Failed to set the package status of package %1 with error: %2.

Fields

Name	Description
`PackageName`	—
`ErrorCode`	—

Event ID 323 — Failed to remove {PackageName} for the user ({UserSid}) with error: {ErrorCode}.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Failed to remove {PackageName} for the user ({UserSid}) with error: {ErrorCode}.

Fields

Name	Description
`PackageName`	—
`UserSid`	—
`ErrorCode`	—

Event ID 324 — Package runtime information %1 failed to refresh because the following error %2 occurred in operation type %3.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Package runtime information %1 failed to refresh because the following error %2 occurred in operation type %3.

Fields

Name	Description
`FileName`	—
`ErrorCode`	—
`Type`	—
`ProcessId`	—

Event ID 325 — %1 is registered in good state, skip re-registering it.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

%1 is registered in good state, skip re-registering it

Fields

Name	Description
`PackageFamilyName`	—

Event ID 326 — Determining packages to be installed during logon for user.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational
Level: 5
Samples: 1

Message

Determining packages to be installed during logon for user: %1.

Fields

Name	Description
`UserSid`	Determining packages to be installed during logon for user.
`IsSpecialUserProfile`	—

Example Event

system:
  provider: Microsoft-Windows-AppXDeployment
  guid: 8127F6D4-59F9-4ABF-8952-3E3A02073D5F
  event_source_name: ''
  event_id: 326
  version: 0
  level: 5
  task: 0
  opcode: 0
  keywords: 4611686018427453440
  time_created: '2023-11-06T06:25:42.557627+00:00'
  event_record_id: 21
  correlation: {}
  execution:
    process_id: 1864
    thread_id: 3472
  channel: Microsoft-Windows-AppXDeployment/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  UserSid: ''
  IsSpecialUserProfile: false
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 327 — The following packages will be installed.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational
Level: 5
Samples: 1

Message

The following packages will be installed: %1. The following packages will be removed: %2

Fields

Name	Description
`InstallPackageList`	The following packages will be installed.
`RemovePackageList`	—

Example Event

system:
  provider: Microsoft-Windows-AppXDeployment
  guid: 8127F6D4-59F9-4ABF-8952-3E3A02073D5F
  event_source_name: ''
  event_id: 327
  version: 0
  level: 5
  task: 0
  opcode: 0
  keywords: 4611686018427453440
  time_created: '2023-11-06T06:25:51.768104+00:00'
  event_record_id: 22
  correlation: {}
  execution:
    process_id: 1864
    thread_id: 3472
  channel: Microsoft-Windows-AppXDeployment/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  InstallPackageList: 'Microsoft.Windows.CloudExperienceHost_10.0.22621.2361_neutral_neutral_cw5n1h2txyewy
    Microsoft.BioEnrollment_10.0.19587.1000_neutral_neutral_cw5n1h2txyewy Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral_neutral_cw5n1h2txyewy
    MicrosoftWindows.UndockedDevKit_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.UI.Xaml.CBS_8.2305.16002.0_neutral_neutral_8wekyb3d8bbwe
    MicrosoftWindows.Client.Core_1000.22643.1000.0_x64__cw5n1h2txyewy MicrosoftWindows.Client.CBS_1000.22674.1000.0_x64__cw5n1h2txyewy
    Microsoft.Windows.StartMenuExperienceHost_10.0.22621.2215_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.ShellExperienceHost_10.0.22621.2215_neutral_neutral_cw5n1h2txyewy
    windows.immersivecontrolpanel_10.0.6.1000_neutral_neutral_cw5n1h2txyewy Microsoft.549981C3F5F10_3.2204.14815.0_neutral_~_8wekyb3d8bbwe
    CanonicalGroupLimited.UbuntuonWindows_2004.2022.1.0_neutral_~_79rhkp1fndgsc Clipchamp.Clipchamp_2.2.8.0_neutral_~_yxz26nhyzhsrt
    Microsoft.DesktopAppInstaller_2023.1005.18.0_neutral_~_8wekyb3d8bbwe Microsoft.GamingApp_2021.427.138.0_neutral_~_8wekyb3d8bbwe
    Microsoft.GetHelp_10.2201.421.0_neutral_~_8wekyb3d8bbwe Microsoft.Getstarted_2021.2204.1.0_neutral_~_8wekyb3d8bbwe
    Microsoft.HEIFImageExtension_1.0.43012.0_x64__8wekyb3d8bbwe Microsoft.HEVCVideoExtension_1.0.50361.0_x64__8wekyb3d8bbwe
    Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe Microsoft.MicrosoftStickyNotes_4.2.2.0_neutral_~_8wekyb3d8bbwe
    Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x86__8wekyb3d8bbwe
    Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x86__8wekyb3d8bbwe
    Microsoft.Paint_11.2308.30.0_neutral_~_8wekyb3d8bbwe Microsoft.PowerAutomateDesktop_10.0.3735.0_neutral_~_8wekyb3d8bbwe
    Microsoft.RawImageExtension_2.1.30391.0_neutral_~_8wekyb3d8bbwe Microsoft.ScreenSketch_2022.2201.12.0_neutral_~_8wekyb3d8bbwe
    Microsoft.SecHealthUI_1000.25873.9001.0_x64__8wekyb3d8bbwe Microsoft.StorePurchaseApp_12008.1001.113.0_neutral_~_8wekyb3d8bbwe
    Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe Microsoft.UI.Xaml.2.7_7.2208.15002.0_x64__8wekyb3d8bbwe
    Microsoft.UI.Xaml.2.7_7.2208.15002.0_x86__8wekyb3d8bbwe Microsoft.UI.Xaml.2.8_8.2306.22001.0_x64__8wekyb3d8bbwe
    Microsoft.UI.Xaml.2.8_8.2306.22001.0_x86__8wekyb3d8bbwe Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x64__8wekyb3d8bbwe
    Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x86__8wekyb3d8bbwe Microsoft.VCLibs.140.00_14.0.32530.0_x64__8wekyb3d8bbwe
    Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe Microsoft.VP9VideoExtensions_1.0.50901.0_x64__8wekyb3d8bbwe
    Microsoft.WebMediaExtensions_1.0.42192.0_neutral_~_8wekyb3d8bbwe Microsoft.WebpImageExtension_1.0.42351.0_x64__8wekyb3d8bbwe
    Microsoft.Windows.Photos_21.21030.25003.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsAlarms_2022.2202.24.0_neutral_~_8wekyb3d8bbwe
    Microsoft.WindowsCalculator_2021.2307.4.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsCamera_2022.2201.4.0_neutral_~_8wekyb3d8bbwe
    Microsoft.WindowsFeedbackHub_2023.504.1552.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsNotepad_11.2307.27.0_neutral_~_8wekyb3d8bbwe
    Microsoft.WindowsSoundRecorder_2021.2103.28.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsStore_22309.1401.2.0_neutral_~_8wekyb3d8bbwe
    Microsoft.WindowsTerminal_3001.18.2822.0_neutral_~_8wekyb3d8bbwe Microsoft.Xbox.TCUI_1.23.28004.0_neutral_~_8wekyb3d8bbwe
    Microsoft.XboxGameOverlay_1.47.2385.0_neutral_~_8wekyb3d8bbwe Microsoft.XboxGamingOverlay_2.622.3232.0_neutral_~_8wekyb3d8bbwe
    Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe
    MicrosoftCorporationII.QuickAssist_2022.414.1758.0_neutral_~_8wekyb3d8bbwe MicrosoftWindows.Client.WebExperience_423.23500.0.0_neutral_~_cw5n1h2txyewy
    1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy
    c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
    E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy
    F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
    Microsoft.AccountsControl_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.AsyncTextService_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe
    Microsoft.CredDialogHost_10.0.19595.1001_neutral_neutral_cw5n1h2txyewy Microsoft.ECApp_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe
    Microsoft.LockApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.MicrosoftEdgeDevToolsClient_10.0.22621.1_neutral__8wekyb3d8bbwe
    Microsoft.Win32WebViewHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.AppRep.ChxApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.AssignedAccessLockApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.CallingShellApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.ContentDeliveryManager_10.0.22621.2361_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.NarratorQuickStart_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe
    Microsoft.Windows.ParentalControls_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.PeopleExperienceHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.PinningConfirmationDialog_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.PrintQueueActionCenter_1.0.1.0_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.SecureAssessmentBrowser_10.0.22621.900_neutral_neutral_cw5n1h2txyewy
    Microsoft.Windows.XGpuEjectDialog_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.WindowsAppRuntime.CBS_4000.1000.1727.0_x64__8wekyb3d8bbwe
    Microsoft.XboxGameCallableUI_10.0.22621.1_neutral_neutral_cw5n1h2txyewy MicrosoftWindows.Client.FileExp_1000.22651.1000.0_x64__cw5n1h2txyewy
    NcsiUwpApp_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy
    Windows.PrintDialog_6.2.2.0_neutral_neutral_cw5n1h2txyewy '
  RemovePackageList: 'NULL'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 328 — Unable to determine packages to be installed during logon with error.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational
Level: 2
Samples: 1

Message

Unable to determine packages to be installed during logon with error: %1.

Fields

Name	Description
`ErrorCode`	Unable to determine packages to be installed during logon with error.

Example Event

system:
  provider: Microsoft-Windows-AppXDeployment
  guid: 8127F6D4-59F9-4ABF-8952-3E3A02073D5F
  event_source_name: ''
  event_id: 328
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 4611686018427453440
  time_created: '2023-10-25T22:52:41.304385+00:00'
  event_record_id: 18
  correlation:
    ActivityID: 61A55000-55E5-1017-0000-000000000000
  execution:
    process_id: 536
    thread_id: 796
  channel: Microsoft-Windows-AppXDeployment/Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-18
event_data:
  ErrorCode: '0x800401f0'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 329 — User Profile created for %1 with path %2 and type %3.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

User Profile created for %1 with path %2 and type %3.

Fields

Name	Description
`UserSid`	—
`ProfilePath`	—
`ProfileType`	—

Event ID 330 — User Profile deleted for %1 with path %2 and type %3.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

User Profile deleted for %1 with path %2 and type %3.

Fields

Name	Description
`UserSid`	—
`ProfilePath`	—
`ProfileType`	—

Event ID 331 — Outdated packages registered to user %1: %2.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Outdated packages registered to user %1: %2. Corresponding up-to-date packages: %3

Fields

Name	Description
`UserSid`	—
`OutdatedPackages`	—
`UpToDatePackages`	—

Event ID 332 — Deployment operation %2 on %1 with options %3 and calling process %4 with callstack %5.

Provider: Microsoft-Windows-AppXDeployment
Channel: Operational

Message

Deployment operation %2 on %1 with options %3 and calling process %4 with callstack %5

Fields

Name	Description
`mainParam`	—
`deploymentOperation`	—
`deploymentOptions`	—
`callerProcess`	—
`callstack`	—

Event ID 1001 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1002 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1003 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1004 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1005 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1006 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1007 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1008 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1009 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1010 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1011 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1012 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1013 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1014 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1015 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1016 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1017 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1018 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1019 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1020 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1021 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1022 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1023 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1024 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1025 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1026 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1027 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1028 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1029 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1030 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1031 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1032 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1033 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Fields

Name	Description
`ErrorCode`	—

Event ID 1034 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1035 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1036 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1037 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1038 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1039 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1040 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1041 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1042 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1043 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1044 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1045 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1046 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1047 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1048 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1049 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1050 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1051 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1052 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1053 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1054 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1055 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1056 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1057 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1058 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1059 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1060 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic

Event ID 1061 —

Provider: Microsoft-Windows-AppXDeployment
Channel: Diagnostic