Microsoft-Windows-AppXDeployment-Server
2020 events across 5 channels
Event ID 300 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | 1 package due to the following error. |
ErrorCode | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 300
version: 0
level: 2
task: 1
opcode: 0
keywords: 4611686018427387908
time_created: '2023-11-06T06:22:35.295778+00:00'
event_record_id: 5850
correlation:
ActivityID: 626F7C94-1079-0002-5E87-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageName: MicrosoftWindows.Client.FileExp_cw5n1h2txyewy
ErrorText: "Package could not be registered.\r\n"
ErrorCode: '0x80073cf6'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 301 — error {ErrorCode}: Cannot update the {PackageName} package due to the following error: {ErrorText}.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 302 — error %3: Cannot de-register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 303 — error %1: While preparing to process the request, the system failed to register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 304 — error {ErrorCode}: While preparing to update the {PackageName} package; the system failed to register the {CategoryName} extension due to the follo...
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
CategoryName | — |
ErrorMessage | — |
Event ID 305 — %1: While preparing to register the request, the system failed to register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 306 — error %1: While processing the request, the system failed to register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | 3 extension due to the following error. |
CategoryName | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 306
version: 0
level: 2
task: 1
opcode: 0
keywords: 4611686018427387908
time_created: '2023-11-06T06:22:35.293410+00:00'
event_record_id: 5848
correlation:
ActivityID: 626F7C94-1079-0002-5E87-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
ErrorCode: '0x800706d9'
ErrorMessage: "There are no more endpoints available from the endpoint mapper.\r\n"
CategoryName: windows.firewall
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 307 — error {ErrorCode}: While updating the {PackageName} package; the system failed to register the {CategoryName} extension due to the following error:...
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
CategoryName | — |
ErrorMessage | — |
Event ID 310 — error %1: Cannot register the request because the following error was encountered while initializing the %3 extension: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 311 — error %1 : Cannot register the request because the following error was encountered while creating the %3 extension: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 312 — Injected a failure on evaluate due to the following error: %2 (%1).
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
Event ID 313 — Injected a failure on commit due to the following error: %2 (%1).
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
Event ID 314 — error %1: While removing the request, the system failed to de-register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 315 — error %1: While reverting the request, the system failed to de-register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 316 — error %1: Cannot register the request because the following error was encountered during the registration of the %3 extension: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | 3 extension. |
CategoryName | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 316
version: 0
level: 2
task: 1
opcode: 0
keywords: 4611686018427387908
time_created: '2023-11-06T06:22:35.293572+00:00'
event_record_id: 5849
correlation:
ActivityID: 626F7C94-1079-0002-5E87-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
ErrorCode: '0x800706d9'
ErrorMessage: "There are no more endpoints available from the endpoint mapper.\r\n"
CategoryName: windows.firewall
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 317 — {FileName}({Line};{Column}): warning: The '{ExtensionName}' extension category in the {PackageName} package is unrecognized.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ExtensionName | — |
PackageName | — |
Event ID 318 — error %3: Cannot register the %1 package because the following error was encountered while determining the level of trust for the package: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 319 — error %3: Cannot register the %1 package because the following error was encountered: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 320 — error %3: Cannot register the %1 package because the following error was encountered while determining whether the package identity is valid: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 321 — error %3: Cannot register the %1 package because the following error was encountered while determining the package's root location: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 322 — error %3: Cannot register the %1 package because the following error was encountered while trying to read the package: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 323 — error %3: Cannot register the %1 package because the following error was encountered while reading the package repository: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 324 — error %1: Failed to load the extension DLL due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
Event ID 325 — error %1: While preparing to process the request, the system failed to register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 326 — error {ErrorCode}: While preparing to update the {PackageName} package; the system failed to register the {CategoryName} extension due to the follo...
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
CategoryName | — |
ErrorMessage | — |
Event ID 327 — %1: While preparing to register the request, the system failed to register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 328 — error %1: While processing the request, the system failed to register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 329 — error {ErrorCode}: While updating the {PackageName} package; the system failed to register the {CategoryName} extension due to the following error:...
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
CategoryName | — |
ErrorMessage | — |
Event ID 330 — error %1: While removing the request, the system failed to de-register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | 3 extension due to the following error. |
CategoryName | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 330
version: 0
level: 3
task: 1
opcode: 0
keywords: 4611686018427387908
time_created: '2023-11-05T22:29:19.840904+00:00'
event_record_id: 7648
correlation:
ActivityID: 59A0D65F-1037-0002-2BF3-A0593710DA01
execution:
process_id: 5296
thread_id: 5800
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
ErrorCode: '0x80070002'
ErrorMessage: "The system cannot find the file specified.\r\n"
CategoryName: windows.sharedFonts
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 331 — error %1: While reverting the request, the system failed to de-register the %3 extension due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 332 — error %1: Cannot register the request because the following error was encountered during the registration of the %3 extension: %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ErrorMessage | — |
CategoryName | — |
Event ID 333 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while determining whether the %7 string resource co...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 334 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while determining whether the %7 file resource coul...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 335 — error %1: An unexpected error occurred while refreshing the shell after a fileType association or protocol change.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 336 —
Event ID 337 —
Event ID 338 — error %1: An unexpected error occurred while refreshing the shell after a fileType association or protocol change.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 339 — Registration will process the {ListType} extensions in the following order: {ExtensionsExecutionOrder}.
Message
Fields
| Name | Description |
|---|---|
ListType | — |
ExtensionsExecutionOrder | — |
Event ID 340 — Registration has successfully created the following extensions on Package %2: %1.
Message
Fields
| Name | Description |
|---|---|
ExtensionsCategoryNames | — |
PackageName | — |
Event ID 341 — Cannot open manifest file for package %1 (%2).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
Event ID 342 — The current impersonation for %1(RunAsSystem:%2) is invalid, we will correct it.
Message
Fields
| Name | Description |
|---|---|
1RunAsSystem | — |
DehName | — |
RunAsSystem | — |
Event ID 343 — Cannot open manifest file for package %1 (%2).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
Event ID 400 — Deployment %1 operation with target volume %4 on Package %2 from: %3 finished successfully.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Path | 2 from. |
MountPoint | — |
TargetPlatform | — |
SystemVolume | — |
StorageId | — |
IsCentennial | — |
PackageType | — |
IsPackageEncrypted | — |
DeploymentOptions | — |
IsStreamingPackage | — |
IsInRelatedSet | — |
IsPackageUsingBDC | — |
MainPackageFamilyName | — |
CallingProcess | — |
IsOptional | — |
PackageFlags | — |
PackageFlags2 | — |
HasWin32alacarte | — |
HasFullTrust | — |
ExternalLocation | — |
PackageSourceUri | — |
PackageDisplayName | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 400
version: 0
level: 4
task: 3
opcode: 2
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:19.438983+00:00'
event_record_id: 6812
correlation:
ActivityID: 626F7C94-1079-0000-B9AE-6F627910DA01
execution:
process_id: 1532
thread_id: 1660
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentOperation: 12
PackageFullName: MicrosoftWindows.Client.WebExperience_423.23500.0.0_neutral_~_cw5n1h2txyewy
Path: ' '
MountPoint: 'C:'
TargetPlatform: '0x3'
SystemVolume: true
StorageId: \\?\Volume{7597d2a3-4404-4f99-b979-6233378a81bf}
IsCentennial: false
PackageType: '0x8'
IsPackageEncrypted: false
DeploymentOptions: '0x10000020'
IsStreamingPackage: false
IsInRelatedSet: false
IsPackageUsingBDC: false
MainPackageFamilyName: 'NULL'
CallingProcess: ''
IsOptional: false
PackageFlags: '0x0'
PackageFlags2: '0x800'
HasWin32alacarte: false
HasFullTrust: false
ExternalLocation: ''
PackageSourceUri: ''
PackageDisplayName: ' '
message: ''
Sigma Rules
- Potential Malicious AppX Package Installation Attempts
Detects potential installation or installation attempts of known malicious appx packages - Windows AppX Deployment Full Trust Package Installation
Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 401 — Deployment %1 operation with target volume %5 on Package %2 from: %3 failed with error %4.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Path | 2 from. |
ErrorCode | — |
MountPoint | — |
TargetPlatform | — |
SystemVolume | — |
StorageId | — |
IsCentennial | — |
PackageType | — |
IsPackageEncrypted | — |
DeploymentOptions | — |
IsStreamingPackage | — |
IsInRelatedSet | — |
IsPackageUsingBDC | — |
MainPackageFamilyName | — |
CallingProcess | — |
IsInPlaceUpdate | — |
ErrorFileInfo | — |
DetailedMessageInfo | — |
RollbackErrorFileInfo | — |
RollbackDetailedMessageInfo | — |
IsOptional | — |
PackageFlags | — |
PackageFlags2 | — |
HasWin32alacarte | — |
HasFullTrust | — |
ExternalLocation | — |
PackageSourceUri | — |
PackageDisplayName | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 401
version: 0
level: 2
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:22:44.338089+00:00'
event_record_id: 6090
correlation:
ActivityID: 626F7C94-1079-0000-A09A-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentOperation: 12
PackageFullName: Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe
Path: ' '
ErrorCode: '0x80070032'
MountPoint: 'C:'
TargetPlatform: '0xffffffff'
SystemVolume: true
StorageId: \\?\Volume{7597d2a3-4404-4f99-b979-6233378a81bf}
IsCentennial: false
PackageType: '0x0'
IsPackageEncrypted: false
DeploymentOptions: '0x10000020'
IsStreamingPackage: false
IsInRelatedSet: false
IsPackageUsingBDC: false
MainPackageFamilyName: 'NULL'
CallingProcess: ''
IsInPlaceUpdate: '0x0'
ErrorFileInfo: indexingstatehandler.cpp,3328,80070032;appxlog.cpp,862,800706BA;indexingstatehandler.cpp,3329,80070032;indexingstatehandler.cpp,4036,80070032;indexingstatehandler.cpp,6315,80070032;deploymentmanager.cpp,276,80070032;deploymentrequest.cpp,2318,80070032;deploymentrequest.cpp,2568,80070032;errorhelpers.cpp,58,8007029C;errorhelpers.cpp,58,8007029C;deploymentrequest.cpp,3339,80073CF9;
DetailedMessageInfo: '[{GetErrorInfo reports there is no error object to return}];[{Deployment''s
currentstate (4) did progress far enough to pause. Staged state is (17)}];'
RollbackErrorFileInfo: 'NULL'
RollbackDetailedMessageInfo: 'NULL'
IsOptional: 0
PackageFlags: '0x0'
PackageFlags2: '0x0'
HasWin32alacarte: false
HasFullTrust: false
ExternalLocation: ''
PackageSourceUri: ''
PackageDisplayName: ''
message: ''
Sigma Rules
- AppX Package Deployment Failed Due to Signing Requirements
Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn't meet the signing requirements. - Potential Malicious AppX Package Installation Attempts
Detects potential installation or installation attempts of known malicious appx packages
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 402 — error %2: Reading manifest from location: %1 failed with error: %3.
Message
Fields
| Name | Description |
|---|---|
ManifestPath | — |
ErrorCode | — |
ErrorString | — |
Event ID 403 — error %2: Failure to get staging session for: %1.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
ErrorCode | — |
Event ID 404 — AppX Deployment operation failed for package %2 with error %3.
Message
Fields
| Name | Description |
|---|---|
SummaryError | 3. The specific error text for this failure is. |
PackageFullName | — |
ErrorCode | — |
MountPoint | — |
TargetPlatform | — |
CallingProcess | — |
ExternalLocation | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 404
version: 0
level: 2
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:22:44.342509+00:00'
event_record_id: 6091
correlation:
ActivityID: 626F7C94-1079-0000-A09A-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
SummaryError: Deployment operation failed.
PackageFullName: Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe
ErrorCode: '0x80073cf9'
MountPoint: 'C:'
TargetPlatform: '0xffffffff'
CallingProcess: ''
ExternalLocation: ''
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 405 — error %2: Opening file from location: %1 failed with error: %3.
Message
Fields
| Name | Description |
|---|---|
ManifestPath | — |
ErrorCode | — |
ErrorString | — |
Event ID 406 — Windows cannot register the package %1 because the specified value from the DeploymentOptions enumeration is DevelopmentMode.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 407 — The current user has already installed an unpackaged version of this app.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
PublisherName | — |
Event ID 408 — Another user has already installed an unpackaged version of this app.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
PublisherName | — |
Event ID 409 — The current user has already installed a packaged version of this app.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
PublisherName | — |
Event ID 410 — Another user has already installed a packaged version of this app.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
PublisherName | — |
Event ID 411 — Windows cannot install package %1 because this package requires a higher Windows version.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
RequestedVersionMajor | — |
RequestedVersionMinor | — |
RequestedVersionAppModel | — |
OSVersionMajor | — |
OSVersionMinor | — |
OSVersionAppModel | — |
Event ID 412 — error %2: Deployment of package %1 was blocked by AppLocker.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
Sigma Rules
- Deployment AppX Package Was Blocked By AppLocker
Detects an appx package deployment that was blocked by AppLocker policy.
Event ID 413 — Deployment of package %1 with package origin %2 failed because no valid license or sideloading policy could be applied.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
PackageOrigin | — |
Event ID 414 — Checking whether deployment is in developer mode because package %1 is unsigned.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 415 — The check for the origin of package %1 returned %2 origin.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
SignatureOrigin | — |
Event ID 416 — The check for enterprise qualifications to approve package %1 returned %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
CheckResult | — |
Event ID 417 — The check for a developer license to approve package %1 returned %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
CheckResult | — |
Event ID 418 — error %2: The package %1 being removed cannot be automatically closed; some part of the package may exist temporarily.
Message
Fields
| Name | Description |
|---|---|
filename | — |
Error | — |
Event ID 419 — error %2: Unable to install because the following apps need to be closed %1.
Message
Fields
| Name | Description |
|---|---|
filename | — |
Error | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 419
version: 0
level: 2
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T01:44:18.900522+00:00'
event_record_id: 9506
correlation:
ActivityID: E4DB489E-1037-0001-9089-F2E43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
filename: MicrosoftTeams_23258.704.2395.9691_x64__8wekyb3d8bbwe
Error: '0x80073d02'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 420 — Windows cannot install package {PackageName} because this package depends on another package that could not be found.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DependencyMinVersion | — |
DependencyName | — |
DependencyPublisher | — |
Event ID 421 — Package {PackageName} requires minimum version {DependencyMinVersion} of framework {DependencyName} published by {DependencyPublisher} to install.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DependencyMinVersion | — |
DependencyName | — |
DependencyPublisher | — |
Event ID 422 — Windows cannot install framework %1 because it declares a dependency.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 423 — Windows cannot register package %1 because it is in development mode and the package is already installed.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 424 — Windows cannot remove framework %1 because package(s)%2 currently depends on the framework.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 424
version: 0
level: 2
task: 4
opcode: 0
keywords: 4611686018427387905
time_created: '2023-10-25T22:53:47.809178+00:00'
event_record_id: 4642
correlation:
ActivityID: D5BBEBF4-0795-0002-BB13-BCD59507DA01
execution:
process_id: 5348
thread_id: 7452
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDevEval
security:
user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
PackageMoniker: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe
PackageMoniker2: ' Microsoft.Windows.Photos'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 425 — Windows cannot remove framework %1 because package(s)%2 currently depends on the framework.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 427 — Windows cannot install package %1 because it has version %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
PackageVersion | — |
PackageVersion2 | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 427
version: 0
level: 2
task: 4
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T22:29:17.055953+00:00'
event_record_id: 7593
correlation:
ActivityID: 59A0D65F-1037-0001-E4F0-A0593710DA01
execution:
process_id: 5296
thread_id: 5800
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
PackageName: Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe
PackageVersion: 14.0.30704.0
PackageVersion2: 14.0.32530.0
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 428 — Windows cannot install package %1 because package %2 was provided but not used.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 429 — Windows cannot install package %1 because a different package %2 with the same name is already installed.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 430 — Windows cannot update package %1 because the previous version is not installed.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 431 — Windows cannot install package %1 because it depends on another package with the same name.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 432 — Windows cannot install package %1 because the package requires architecture %2, but this computer has architecture %3.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
PackageArchitecture | — |
MachineArchitecture | — |
Event ID 433 — Windows cannot remove non-qualified resource package %1 because package(s)%2 currently depends on the package.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 434 — Windows cannot install package {PackageName} because this package depends on another package that could not be found.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DependencyMinVersion | — |
DependencyName | — |
DependencyPublisher | — |
Event ID 435 — Package {PackageName} requires minimum version {DependencyMinVersion} of framework {DependencyName} published by {DependencyPublisher} to install.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DependencyMinVersion | — |
DependencyName | — |
DependencyPublisher | — |
FrameworkList | — |
Event ID 436 — Package {PackageName} requires minimum version {DependencyMinVersion} of framework {DependencyName} published by {DependencyPublisher} to install.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DependencyMinVersion | — |
DependencyName | — |
DependencyPublisher | — |
Event ID 437 — Windows cannot install resource package %1 because the app package it requires could not be found.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 438 — Framework %1 is no longer explicitly installed but remains implicitly installed because packages still depend on it.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 438
version: 0
level: 5
task: 4
opcode: 0
keywords: 4611686018427387905
time_created: '2023-10-25T22:54:15.216190+00:00'
event_record_id: 4935
correlation:
ActivityID: D5BBEBF4-0795-0001-E929-BCD59507DA01
execution:
process_id: 5348
thread_id: 7452
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDevEval
security:
user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
PackageMoniker: Microsoft.UI.Xaml.2.7_7.2208.15002.0_x86__8wekyb3d8bbwe
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 439 — Windows cannot install the bundle because the resource Id of the resource package %1 is invalid as it is the same as the resource id of the main pa...
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 440 — Package %1 with %2 origin cannot be sideloaded or installed using developer mode option.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
SignatureOrigin | — |
Event ID 441 — The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy.
Message
Sigma Rules
- Deployment Of The AppX Package Was Blocked By The Policy
Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an AppX package deployment was blocked by a policy: - Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy - Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy." - Event ID 453: Package blocked by a platform policy. - Event ID 454: Package blocked by a platform policy.
Event ID 442 — Deployment of package %1 to volume %2 failed because deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps...
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
MountPoint | — |
Sigma Rules
- Deployment Of The AppX Package Was Blocked By The Policy
Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an AppX package deployment was blocked by a policy: - Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy - Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy." - Event ID 453: Package blocked by a platform policy. - Event ID 454: Package blocked by a platform policy.
Event ID 443 — Failed to initialize a MRT resource manager for the inbox application: %1 and file path: %2 .
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FilePath | — |
Event ID 444 — Failed to initialize a MRT resource manager for the package: %1 and file path: %2 .
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FilePath | — |
Event ID 445 — GetFullyQualifiedReference from the File Resource Map for package full name: {PackageFullName} and reference string: {ReferenceString} failed.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ReferenceString | — |
Event ID 446 — GetFullyQualifiedReference from the Main Resource Map for package full name: {PackageFullName} and reference string: {ReferenceString} failed.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ReferenceString | — |
Event ID 447 — GetFullyQualifiedReference from the String Resource Map for package full name: {PackageFullName} and reference string: {ReferenceString} failed.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ReferenceString | — |
Event ID 448 — Merging resource PRIs failed with error %2 for paths: %1.
Message
Fields
| Name | Description |
|---|---|
PriPaths | — |
ErrorCode | — |
Event ID 449 — Writing registry key for user %1 returned %4.
Message
Fields
| Name | Description |
|---|---|
UserSid | — |
NewMainPackageFullName | — |
OldMainPackageFullName | — |
ErrorCode | — |
Online | — |
Event ID 450 — Package dependency %1 could not be found in the repository database.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 451 — Skipping some operations for remove of package %1 due to repair.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 452 — Can't complete the applocker check for %2 because %1.
Message
Fields
| Name | Description |
|---|---|
reason | — |
package | — |
Event ID 453 — Package %1 is blocked by a platform policy: %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
PolicyReason | — |
Sigma Rules
- Deployment Of The AppX Package Was Blocked By The Policy
Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an AppX package deployment was blocked by a policy: - Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy - Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy." - Event ID 453: Package blocked by a platform policy. - Event ID 454: Package blocked by a platform policy.
Event ID 454 — Package %1 is blocked by a platform policy: %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
PolicyReason | — |
Sigma Rules
- Deployment Of The AppX Package Was Blocked By The Policy
Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an AppX package deployment was blocked by a policy: - Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy - Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy." - Event ID 453: Package blocked by a platform policy. - Event ID 454: Package blocked by a platform policy.
Event ID 455 — User %1 had outdated package %3, which will be updated to %2.
Message
Fields
| Name | Description |
|---|---|
UserSid | — |
NewMainPackageFullName | — |
OldMainPackageFullName | — |
ErrorCode | — |
Online | — |
Event ID 456 — Removed registry for package %2 for user %1.
Message
Fields
| Name | Description |
|---|---|
UserSid | — |
MainPackageFullName | — |
ErrorCode | — |
Event ID 457 — Deployment of package %1 to volume %2 failed because deployments to non-system volumes are blocked for this package's package family.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
MountPoint | — |
Event ID 458 — Deployment of package %1 to volume %2 failed because deployments to non-system volumes are blocked on this machine.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
MountPoint | — |
Event ID 459 — Error %4: Deployment of package %3 failed becuase user %1 with package %2 is logged in.
Message
Fields
| Name | Description |
|---|---|
UserSid | — |
NewMainPackageFullName | — |
OldMainPackageFullName | — |
ErrorCode | — |
Online | — |
Event ID 460 — error %2: Creating DataSource to %1 failed.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
ErrorCode | — |
Event ID 461 — error %2: Creating folder %1 failed.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 462 — error %2: Creating file %1 failed.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 463 — Writing to file %1 at offset %2 of size %3 failed.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Offset | — |
Size | — |
Event ID 464 — error %2: Hard linking to file %1 failed.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 465 — error %2: Opening the package from location %1 failed.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
ErrorCode | — |
Event ID 466 — error %2: Creating the package metadata directory %1 failed.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 467 — error %2: Setting file attributes for package metadata directory %1 failed.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 468 — error %2: Failed to set access rights to %1.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 469 — Integrity check failed for file %1.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 470 — error %3: Package update failed for %1.
Message
Fields
| Name | Description |
|---|---|
PackageMonikerOld | — |
PackageMonikerNew | — |
ErrorCode | — |
Event ID 471 — error %2: Deleting file %1 failed.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 472 — Moving package folder %1 to %2.
Message
Fields
| Name | Description |
|---|---|
SourceFolderPath | — |
DestinationFolderPath | — |
ErrorCode | 2. Result. |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 472
version: 0
level: 5
task: 5
opcode: 0
keywords: 4611686018427387905
time_created: '2023-10-25T21:56:30.734001+00:00'
event_record_id: 4352
correlation:
ActivityID: D6B877D5-078C-0000-524F-B9D68C07DA01
execution:
process_id: 4436
thread_id: 1864
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDevEval
security:
user_id: S-1-5-18
event_data:
SourceFolderPath: \\?\C:\Program Files\WindowsApps\Microsoft.WindowsStore_22204.1400.4.0_x64__8wekyb3d8bbwe
DestinationFolderPath: \\?\C:\Program Files\WindowsApps\Deleted\Microsoft.WindowsStore_22204.1400.4.0_x64__8wekyb3d8bbwe0e936392-5284-49da-af5f-c9e38f839093
ErrorCode: '0x0'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 473 — Failed to read signature of already-installed package %2 with error %1; installation is assumed to be corrupted.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 474 — Deployment of package %1 was blocked because the provided package has the same identity as an already-installed package but the contents are differ...
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 475 — error %2: Reading manifest from location: %1 failed with error: %3.
Message
Fields
| Name | Description |
|---|---|
ManifestPath | — |
ErrorCode | — |
ErrorString | — |
Event ID 476 — Service is being shut down forcefully while still executing a deployment request.
Message
Fields
| Name | Description |
|---|---|
RequestCount | — |
QueueLength | — |
LazyFlushQueueLength | — |
IdleTaskInProgress | — |
Event ID 477 — Hard linking file %1 to %2 failed with HRESULT %3.
Message
Fields
| Name | Description |
|---|---|
SourceFilePath | — |
LinkDestinationPath | — |
ErrorCode | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 477
version: 0
level: 3
task: 50
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T01:43:39.305535+00:00'
event_record_id: 9492
correlation:
ActivityID: E4DB489E-1037-0001-CE30-F2E43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
SourceFilePath: desktop-assets\serve-configs\work.json
LinkDestinationPath: \\?\C:\Program Files\WindowsApps\MicrosoftTeams_23258.704.2395.9691_x64__8wekyb3d8bbwe\desktop-assets\serve-configs\work.json
ErrorCode: '0x80073cfc'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 478 — Deployment %1 operation with target volume %4 on Package %2 from: %3 finished successfully.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Path | 2 from. |
MountPoint | — |
TargetPlatform | — |
SystemVolume | — |
StorageId | — |
IsCentennial | — |
PackageType | — |
IsPackageEncrypted | — |
DeploymentOptions | — |
IsStreamingPackage | — |
IsInRelatedSet | — |
IsPackageUsingBDC | — |
MainPackageFamilyName | — |
CallingProcess | — |
IsOptional | — |
PackageFlags | — |
PackageFlags2 | — |
HasWin32alacarte | — |
HasFullTrust | — |
ExternalLocation | — |
PackageSourceUri | — |
PackageDisplayName | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 478
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:19.442883+00:00'
event_record_id: 6813
correlation:
ActivityID: 626F7C94-1079-0000-B9AE-6F627910DA01
execution:
process_id: 1532
thread_id: 1660
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentOperation: 12
PackageFullName: MicrosoftWindows.Client.WebExperience_423.23500.0.0_x64__cw5n1h2txyewy
Path: ' '
MountPoint: 'C:'
TargetPlatform: '0x3'
SystemVolume: true
StorageId: \\?\Volume{7597d2a3-4404-4f99-b979-6233378a81bf}
IsCentennial: true
PackageType: '0x1'
IsPackageEncrypted: false
DeploymentOptions: '0x10000020'
IsStreamingPackage: false
IsInRelatedSet: false
IsPackageUsingBDC: false
MainPackageFamilyName: 'NULL'
CallingProcess: ''
IsOptional: false
PackageFlags: '0x88004c'
PackageFlags2: '0x800'
HasWin32alacarte: false
HasFullTrust: true
ExternalLocation: ''
PackageSourceUri: ''
PackageDisplayName: Windows Web Experience Pack
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 479 — error %2: Creating the system metadata directory %1 failed.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 480 — error %2: Deleting the system metadata directory %1 failed.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 481 — error %2: Opening the loose file package from location %1 failed.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
ErrorCode | — |
Event ID 482 — error %2: Creating file %1 failed.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCode | — |
Event ID 483 — error %3: Package volume operation %1 for %2 failed at line %4.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageName | — |
ErrorCode | — |
LineNumber | — |
Event ID 484 — error %3: Package volume state update for %1 failed for user %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
UserSid | — |
ErrorCode | — |
AppDataErrorOperation | — |
Event ID 485 — error %3: No package table row %1 associated with visibility table row for user %2.
Message
Fields
| Name | Description |
|---|---|
PackageTableRowKey | — |
UserSid | — |
ErrorCode | — |
Event ID 486 — AppX Deployment operation failed with error %2 from API %1.
Message
Fields
| Name | Description |
|---|---|
SummaryError | — |
ErrorCode | — |
Event ID 487 — Removing directory %2 failed with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
Event ID 488 — Error %1: Could not mount volume with Single Instance Store %2 and Media ID %4.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
VolumeID | — |
MediaID | — |
Event ID 489 — Notification to setting monitor of the change to %1 failed with error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 490 — Found partially downloaded file to resume.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Offset | — |
Size | — |
Event ID 491 — Resume requires full block hash validation for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 492 — Removing mounted folder %2 failed with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
Event ID 493 — There were %2 additional files that failed to be deleted under the folder %1.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
ErrorCount | — |
Event ID 494 — There were %1 additional files that failed to be hardlinked.
Message
Fields
| Name | Description |
|---|---|
ErrorCount | — |
Event ID 495 — %2 in MsixvcStagingSession failed with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 496 — Invalid footprint file %2 for package %3, error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 497 — Error %2: Opening the Msixvc package from location %1 failed.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
ErrorCode | — |
Event ID 498 — MSIXVC data source called to remove package %1 root %2 successfully.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
Event ID 499 — Removing mounted package folder %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 500 — Framework package %1 download failed, file write size is %2, actual file size is %3.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Writesize | — |
Filesize | — |
Event ID 501 — error %3: Failed to delete %2 for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ResourceName | — |
ErrorCode | — |
Event ID 502 — Successfully deleted %2 for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ResourceName | — |
Event ID 503 — The file system entries for package %1 could not be cleaned up after reboot.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 504 — Error %1: Failed to Scavenge Application Data from volume %2 with media ID %3.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
MediaID | — |
UserSid | — |
Package | — |
Event ID 505 — Error %1: Failed to Scavenge Application Data for User %4 from volume %2 with media ID %3.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
MediaID | — |
UserSid | — |
Package | — |
Event ID 506 — Error %1: Failed to Scavenge Application Data for User %4 and Package %5 from volume %2 with media ID %3.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
MediaID | — |
UserSid | — |
Package | — |
Event ID 507 — Succeeded to Scavenge Application Data for User %4 and Package %5 from volume %2 with media ID %3.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
MediaID | — |
UserSid | — |
Package | — |
Event ID 508 — Removing orphan package in path %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 509 — Finished scanning and cleaning up orphan packages.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 510 — Successfully Removed orphan backup manifest %1.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Event ID 511 — Removing orphan backup manifest %1 failed.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
Event ID 512 — Staging session streaming data source prefetch canceled, session key %1, data source prefetch canceled %2.
Message
Fields
| Name | Description |
|---|---|
SessionKey | — |
StreamingDataSourcePrefetchCanceled | — |
Event ID 520 — error %1: Windows cannot process a deployment operation because the package repository database encountered an unrecoverable error.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 521 — error {ErrorCode}: Windows cannot find the repository database.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 522 — error %2: Failed to create package repository folder %1.
Message
Fields
| Name | Description |
|---|---|
FolderPath | — |
ErrorCode | — |
Event ID 523 —
Fields
| Name | Description |
|---|---|
FolderPath | — |
ErrorCode | — |
Reason | — |
Event ID 523 — error %2: Failed to open package manifest file %1 due to reason %3.
Message
Fields
| Name | Description |
|---|---|
FolderPath | — |
ErrorCode | — |
Reason | — |
Event ID 530 — Failed to create data source provider with CLSID %1.
Message
Fields
| Name | Description |
|---|---|
CLSID | — |
ErrorCode | — |
Event ID 531 — Failed to get the stream from the undocked data source for Uri.
Message
Fields
| Name | Description |
|---|---|
Uri | — |
ErrorCode | — |
Event ID 532 — Failed to shut down the userdatasource.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 533 — Shut down the userdatasource.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 540 — Started bytecode generation for package %1 on %2-bit architecture.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Architecture | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 540
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:20.607337+00:00'
event_record_id: 6902
correlation: {}
execution:
process_id: 1532
thread_id: 1016
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe
Architecture: 32
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 541 — Finished bytecode generation for package %1 on %2-bit architecture.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Architecture | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 541
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:22.167962+00:00'
event_record_id: 6937
correlation: {}
execution:
process_id: 1532
thread_id: 1016
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe
Architecture: 32
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 542 — %3: Failed to generate bytecode for package %1 on %2-bit architecture.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Architecture | — |
ErrorCode | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 542
version: 0
level: 2
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:18.616725+00:00'
event_record_id: 6811
correlation:
ActivityID: 626F7C94-1079-0000-B9AE-6F627910DA01
execution:
process_id: 1532
thread_id: 1660
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: MicrosoftWindows.Client.WebExperience_423.23500.0.0_x64__cw5n1h2txyewy
Architecture: 64
ErrorCode: '0x80070490'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 543 — Failed to generate bytecode for %3 JS files in package %1 on %2-bit architecture.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Architecture | — |
Count | — |
Event ID 544 — File %2 in package %1 is missing the UTF-8 BOM.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FullFilePath | — |
Event ID 545 — Script error occurred in file %2 in package %1 at line: %5 column: %6.
Message
Fields
| Name | Description |
|---|---|
ErrorText | — |
ErrorDescription | — |
column | — |
PackageFullName | — |
FullFilePath | — |
LineNumber | — |
ColumnNumber | — |
Event ID 546 — File %2 in package %1 could not be validated from the package blockmap.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FullFilePath | — |
Event ID 547 — ByteCodeGenerator process terminated with exit code %2 for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ExitCode | — |
Event ID 548 — %3: Failed to generate bytecode for %2 in package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FullFilePath | — |
ErrorCode | — |
Event ID 549 — Bytecode for file %2 in package %1 can only be generated at runtime.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FullFilePath | — |
Event ID 550 — Bytecode generation for package %1 on %2-bit architecture got cancelled because of a new deployment operation.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Architecture | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 550
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T01:42:37.605156+00:00'
event_record_id: 9469
correlation:
ActivityID: E4DB489E-1037-0000-FF0E-EDE43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x64__8wekyb3d8bbwe
Architecture: 64
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 551 — ByteCodeGenerator process for package %1 did not shutdown in time.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
waitResult | — |
Event ID 552 — Valid bytecode file %2 is already present for package %1; so bytecode generation is unnecessary.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FullFilePath | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 552
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2022-04-07T17:04:34.495404+00:00'
event_record_id: 561
correlation:
ActivityID: DD7B0B6A-4A9E-0001-314A-7BDD9E4AD801
execution:
process_id: 5972
thread_id: 2672
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WIN-FPV0DSIC9O6
security:
user_id: S-1-5-18
event_data:
PackageFullName: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe
FullFilePath: \\?\C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 553 — Staging failed with error code %1 because package folder %2 does not have the correct ACLs applied.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 560 — Staging roaming data for package %2 failed with error %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 561 — Not staging roaming data for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 562 — Establishing the sync relationship for package %2 failed with error %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 563 — Application Data for package {PackageMoniker} not found at the expected location.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 564 — Application Data for package {PackageMoniker} not found on either destination volume or original volume.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 565 — Alternate staging location was cleared for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 566 — Acquiring roaming data for already registered package %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 567 — Performed deferred roaming data acquirisition for registered package %2 with error %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 568 — Deferring staging of roaming data for package %1 without blocking app launch.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 569 — Deferring staging of roaming data for package %1, will block app launch for roaming data.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 570 — Failed to get or set roaming data status for package %2 with error %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 571 — First user logon Started before installing package %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 572 — First user logon ended before installing package %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 573 — Setting Sync Enabled status, package family name %1, enabled %2.
Message
Fields
| Name | Description |
|---|---|
PackageFamilyName | — |
SettingSyncEnabled | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 573
version: 0
level: 4
task: 47
opcode: 0
keywords: 4611686018427387905
time_created: '2022-04-07T17:04:43.369548+00:00'
event_record_id: 929
correlation:
ActivityID: DD7B0B6A-4A9E-0001-7475-7BDD9E4AD801
execution:
process_id: 5972
thread_id: 904
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WIN-FPV0DSIC9O6
security:
user_id: S-1-5-21-2121334350-1110938707-2888912545-500
event_data:
PackageFamilyName: MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy
SettingSyncEnabled: false
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 574 —
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 574 — Preferred package version for package family is changing.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 575 —
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 575 — Preferred package version for package family is not changing.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 600 — The package %1 was installed for the current user.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 601 — error %3: Unable to recover this package %1 for the current user.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
FileName | — |
ErrorCode | — |
Event ID 602 — Identified %1 request(s) in the Queue Store for potential restoration.
Message
Fields
| Name | Description |
|---|---|
RequestCount | — |
Event ID 603 — Started deployment %1 operation on a package with main parameter %2 and Options %3 and %4.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
Path | — |
Flags | — |
FlagsHigh | — |
CallingProcess | — |
ExternalLocation | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 603
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:22:35.420135+00:00'
event_record_id: 5855
correlation:
ActivityID: 626F7C94-1079-0003-2383-6F627910DA01
execution:
process_id: 1532
thread_id: 1840
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentOperation: 10
Path: MicrosoftWindows.UndockedDevKit_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
Flags: 0
FlagsHigh: 0
CallingProcess: svchost.exe,AppXSvc
ExternalLocation: ''
message: ''
Sigma Rules
- Windows AppX Deployment Unsigned Package Installation
Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 604 — Started deployment %1 operation on a package with main parameter %2, dependency parameters %3 and Options %4 and %5.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
Path | — |
DependencyPaths | — |
Flags | — |
FlagsHigh | — |
CallingProcess | — |
ExternalLocation | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 604
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T23:49:12.453668+00:00'
event_record_id: 9301
correlation:
ActivityID: E4DB489E-1037-0003-729F-E0E43710DA01
execution:
process_id: 6656
thread_id: 10416
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
DeploymentOperation: 27
Path: ''
DependencyPaths: DropboxInc.Dropbox_186.4.6207.0_x86__wkt425jdc3sga
Flags: 268435456
FlagsHigh: 0
CallingProcess: svchost.exe,AppReadiness
ExternalLocation: ''
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 605 — Error %2: Failure in the %1 state handler.
Message
Fields
| Name | Description |
|---|---|
DeploymentState | — |
NextDeploymentState | — |
ErrorCode | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 605
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611756387171565569
time_created: '2023-11-06T06:22:44.278147+00:00'
event_record_id: 6089
correlation:
ActivityID: 626F7C94-1079-0000-A09A-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentState: 4
NextDeploymentState: 5
ErrorCode: '0x80070032'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 606 —
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 606 — OnDemandRegisterPackage %1, skipped due to remove package override in RemoveDefaultPackages policy.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 607 — Deployment %1 operation on package %2 has been de-queued and is running for user SID %3.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
UserSid | — |
CallingProcess | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 607
version: 0
level: 4
task: 0
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:25:52.906007+00:00'
event_record_id: 6959
correlation:
ActivityID: F590C418-1079-0003-E7D4-90F57910DA01
execution:
process_id: 3480
thread_id: 5104
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentOperation: 12
PackageFullName: Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe
UserSid: S-1-5-18
CallingProcess: 'NULL'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 608 — Unable to recover package %1 because it does not have any .
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 609 — Recovering DeploymentRequest from file %4 for %1 Operation on Package %2.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
MainPackageMoniker | — |
ResiliencyCurrentState | — |
ResiliencyFilePath | — |
Event ID 610 — error %2: Recovering DeploymentRequest from file %1 failed.
Message
Fields
| Name | Description |
|---|---|
ResiliencyFilePath | — |
ErrorCode | — |
Event ID 611 — Failed flushing deployment data with result.
Message
Fields
| Name | Description |
|---|---|
HRESULT | — |
Event ID 612 — Could not contact Process Lifetime Management to ensure that no apps are running during servicing.
Message
Event ID 613 — Performance summary of Deployment %1 operation on Package %2: %3.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Summary | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 613
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:22:35.624023+00:00'
event_record_id: 5864
correlation:
ActivityID: 626F7C94-1079-0003-2383-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentOperation: 6
PackageFullName: MicrosoftWindows.UndockedDevKit_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
Summary: "\r\nOverall time: 203 ms\r\nEnqueue cost: 16 ms\r\nDequeue delay: 15 ms\r\nBundle
processing cost: 0 ms\r\nIndexing cost: 16 ms\r\nResolve dependency cost: 15 ms\r\nCheck
approval cost: 0 ms\r\nEvaluation cost: 0 ms\r\nHardlinking evaluation cost: 0
ms\r\nStage required cost: 0 ms\r\nFlushing and closing files cost: 0 ms\r\nMachine
register cost: 0 ms\r\nStage user data cost: 0 ms\r\nRegistration cost: 16 ms\r\nRepository
commit transaction cost: 63 ms\r\nGap: 15 ms\r\nData flush cost: 0 ms\r\nPost
DeStage repository commit transaction cost: 47 ms\r\nRemaining cost: 0 ms\r\n"
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 614 — RemoveDefaultPackages uninstall override policy failure during removal of package %2 with error code %1.
Message
Fields
| Name | Description |
|---|---|
PathOne | — |
PathTwo | 1 contains packages. |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 614
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:17.523047+00:00'
event_record_id: 6799
correlation:
ActivityID: 626F7C94-1079-0000-B9AE-6F627910DA01
execution:
process_id: 1532
thread_id: 1660
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PathOne: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_423.23500.0.0_neutral_~_cw5n1h2txyewy\AppxMetadata\AppxBundleManifest.xml
PathTwo: '"MicrosoftWindows.Client.WebExperience_arm64.appx": MicrosoftWindows.Client.WebExperience_423.23500.0.0_arm64__cw5n1h2txyewy
"MicrosoftWindows.Client.WebExperience_x64.appx": MicrosoftWindows.Client.WebExperience_423.23500.0.0_x64__cw5n1h2txyewy'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 615 — Deployment %1 operation on package %2 has been cancelled by the caller.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Event ID 616 — Relaunching app %1 after the app was serviced.
Message
Fields
| Name | Description |
|---|---|
ApplicationUserModelId | — |
Event ID 617 — Successfully updated the status for package %2 and user %3 (Clear=%4, Set=%5).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
StatusToClear | — |
StatusToSet | — |
CallOrigin | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 617
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T01:44:18.877529+00:00'
event_record_id: 9505
correlation:
ActivityID: E4DB489E-1037-0001-9089-F2E43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: MicrosoftTeams_23258.704.2395.9691_x64__8wekyb3d8bbwe
StatusToClear: '0x0'
StatusToSet: '0x400'
CallOrigin: 0
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 618 — error %1: Unable to update the status for package %2 and user %3 (Clear=%4, Set=%5).
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageFullName | — |
userSid | — |
StatusToClear | — |
StatusToSet | — |
CallOrigin | — |
Event ID 619 — error %3: Unable to change application state for package %1 (BiApplicationStateTransition=%2).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
BiApplicationStateTransition | — |
ErrorCode | — |
Event ID 620 — error %3: Unable to set package status for dependents of package %1 (context=%2).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Context | — |
ErrorCode | — |
Event ID 621 — error %3: Unable to reset package status for dependencies of package %1 (key=%2).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
PackageKey | — |
ErrorCode | — |
Event ID 622 —
Event ID 623 — error %3: Unable to reset package status for dependencies of package %1 (key=%2).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
PackageKey | — |
ErrorCode | — |
Event ID 624 — Started deployment %1 operation on all applications with Options %3 and %4.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
DependencyPaths | — |
Flags | — |
FlagsHigh | — |
CallingProcess | — |
ExternalLocation | — |
Event ID 625 — The package deployment operation is now paused for package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 626 — Deployment %1 operation on package %2 has been requeued for user SID %3.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
UserSid | — |
CallingProcess | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 626
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T01:40:01.081346+00:00'
event_record_id: 9393
correlation:
ActivityID: E4DB489E-1037-0000-40DE-ECE43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentOperation: 4
PackageFullName: Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x86__8wekyb3d8bbwe
UserSid: S-1-5-18
CallingProcess: svchost.exe,wuauserv
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 627 — Windows cannot remove %1 because the current user does not have that package installed.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 628 — Windows cannot install package %1 because this package depends on a framework that could not be found.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DependencyName | — |
DependencyPublisher | — |
DependencyArchitecture | — |
DependencyMinVersion | — |
Event ID 629 — No applicable cross-architecture framework was found for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DependencyName | — |
DependencyPublisher | — |
DependencyArchitecture | — |
DependencyMinVersion | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 629
version: 0
level: 5
task: 4
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T22:33:40.966926+00:00'
event_record_id: 8741
correlation:
ActivityID: E4DB489E-1037-0002-627D-DBE43710DA01
execution:
process_id: 4660
thread_id: 5424
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
PackageName: Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe
DependencyName: Microsoft.UI.Xaml.2.4
DependencyPublisher: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond,
S=Washington, C=US
DependencyArchitecture: 0
DependencyMinVersion: 2.42005.18002.0
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 630 — For PreRegisterPackage, unable to determine visibility state to set for package %2 with error: %1, default to Staged.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 631 —
Fields
| Name | Description |
|---|---|
UupProductId | — |
TotalSizeInMB | — |
PackageSizeInMB | — |
DataSizeInMB | — |
Details | — |
Event ID 631 — Disk usage report of UUP product %1: TotalSize=%2MB, PackageSize=%3MB, DataSize=%4MB.
Message
Fields
| Name | Description |
|---|---|
UupProductId | — |
TotalSizeInMB | — |
PackageSizeInMB | — |
DataSizeInMB | — |
Details | — |
Event ID 632 — Deployment request for %1 operation on package %2 was cancelled because it cannot be resumed from state %3.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
MainPackageMoniker | — |
ResiliencyCurrentState | — |
ResiliencyFilePath | — |
Event ID 633 — PreRegisterPackage %1, IsInstalled=%2, Options=%3.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
IsInstalled | — |
Options | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 633
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:25:52.893333+00:00'
event_record_id: 6958
correlation:
ActivityID: F590C418-1079-0003-E7D4-90F57910DA01
execution:
process_id: 3480
thread_id: 3600
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe
IsInstalled: false
Options: 805306368
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 634 — OnDemandRegisterPackage %1, unable to find the package from StateRepository, we will register it later.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 634
version: 0
level: 3
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T22:32:30.183743+00:00'
event_record_id: 7828
correlation:
ActivityID: E4DB489E-1037-0002-4157-DBE43710DA01
execution:
process_id: 4660
thread_id: 5424
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
PackageMoniker: Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 635 — ServerSideRPCPreRegisterPackage %1, Option: %2, Result: %3, Calling process: %4.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Flags | 1, Option. |
HResult | — |
CallingProcess | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 635
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:25:52.892893+00:00'
event_record_id: 6957
correlation:
ActivityID: F590C418-1079-0003-E6D4-90F57910DA01
execution:
process_id: 3480
thread_id: 3600
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: Microsoft.HEVCVideoExtension_1.0.50361.0_x64__8wekyb3d8bbwe
Flags: 2
HResult: '0x0'
CallingProcess: svchost.exe,AppReadiness
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 636 — ServerSideRPCPreRegisterAllInboxPackages result: %1, Option: %2, Calling process: %3.
Message
Fields
| Name | Description |
|---|---|
HResult | ServerSideRPCPreRegisterAllInboxPackages result. |
Options | — |
CallingProcess | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 636
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:22:35.624138+00:00'
event_record_id: 5865
correlation:
ActivityID: 626F7C94-1079-0003-2383-6F627910DA01
execution:
process_id: 1532
thread_id: 1564
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
HResult: '0x80073cf6'
Options: 2
CallingProcess: Setup.exe
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 637 — Running apps were shut down to allow packages to be updated.
Message
Fields
| Name | Description |
|---|---|
runningAppsList | — |
directlyServicedPackagesList | — |
indirectlyServicedPackagesList | — |
numAttempts | — |
isSessionLocked | — |
forceUpdateDeferredByPackage | — |
Event ID 638 — Packages were not updated because affected apps are still running.
Message
Fields
| Name | Description |
|---|---|
runningAppsList | — |
directlyServicedPackagesList | — |
indirectlyServicedPackagesList | — |
numAttempts | 3}, Number of previous attempts. |
isSessionLocked | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 638
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611756387171565569
time_created: '2023-11-06T01:44:18.852767+00:00'
event_record_id: 9504
correlation:
ActivityID: E4DB489E-1037-0001-9089-F2E43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
runningAppsList: MicrosoftTeams_8wekyb3d8bbwe!MicrosoftTeams
directlyServicedPackagesList: MicrosoftTeams_23275.702.2421.2406_x64__8wekyb3d8bbwe
indirectlyServicedPackagesList: 'NULL'
numAttempts: 0
isSessionLocked: false
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 639 — ServerSideRPCCleanupWCIReparsePoints result.
Message
Fields
| Name | Description |
|---|---|
HResult | ServerSideRPCCleanupWCIReparsePoints result. |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 639
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-10-25T22:55:18.380827+00:00'
event_record_id: 5457
correlation:
ActivityID: D5BBEBF4-0795-0003-C021-BCD59507DA01
execution:
process_id: 5348
thread_id: 7828
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDevEval
security:
user_id: S-1-5-18
event_data:
HResult: '0x0'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 640 — ServerSideEnsurePackageFamilyIsRegistered result.
Message
Fields
| Name | Description |
|---|---|
ServerSideEnsurePackageFamilyIsRegistered_result | — |
HResult | — |
Event ID 641 — OnDemandRegisterPackage %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 642 — OnDemandRegisterPackage found existing package %1, set PACKAGE_STATUS_REGISTRATION_REQUIRED_BLOCKING.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 643 — OnDemandRegisterPackage %1 add PackageUser row, Bundle:%2, AppDataVolume:%3.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Bundle | 1 add PackageUser row, Bundle. |
AppDataVolume | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 643
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T22:40:01.196950+00:00'
event_record_id: 9190
correlation:
ActivityID: E4DB489E-1037-0000-C586-DCE43710DA01
execution:
process_id: 4660
thread_id: 5424
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
PackageFullName: Microsoft.MicrosoftEdge.Stable_119.0.2151.44_neutral__8wekyb3d8bbwe
Bundle: 155
AppDataVolume: 1
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 644 — OnDemandRegisterPackage %1, update Staged to Installed.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 645 — OnDemandRegisterPackage error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 646 — The running app %2 was shut down for servicing (Priority=%1).
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 647 — Removing registrations for DownlevelInstalled package %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 648 — Error %2: Failure in the early preparatory steps of the request or in the %1 state handler.
Message
Fields
| Name | Description |
|---|---|
DeploymentState | — |
NextDeploymentState | — |
ErrorCode | — |
FailedDeploymentState | — |
Event ID 649 — Deployment %1 operation on Package %2: %3.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Summary | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 649
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-10-25T22:11:19.271948+00:00'
event_record_id: 4410
correlation:
ActivityID: 028F2288-078F-0000-DBA0-8F028F07DA01
execution:
process_id: 2324
thread_id: 2560
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDevEval
security:
user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
DeploymentOperation: 6
PackageFullName: Microsoft.Windows.ShellExperienceHost_10.0.22621.2215_neutral_neutral_cw5n1h2txyewy
Summary: ACLs repaired successfully for \\?\C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy.
Register next time should succeed.
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 650 — Error processing appinstaller at resolved path %1.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 651 — Appinstaller operation failed with error code %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 652 — Error processing appinstaller at resolved path %1.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 653 — The package full name returned from the AppxManifest does not match the name generated from the AppInstaller.
Message
Fields
| Name | Description |
|---|---|
PackageNameOne | — |
PackageNameTwo | — |
Path | — |
Event ID 654 — The appinstaller file referenced at %1 is invalid.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 655 — OnDemandRegisterPackage %1, failed to create or update tiles.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 656 — Skipping OnDemandRegisterPackage %1 because it is Paused.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 657 — ServerSideRemovePackageFromContainer result %1.
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 658 — Marking package {.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 659 — Skipping add of {.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 660 — Deployment will return success to the caller instead of {.
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 661 — Windows cannot install package %2 because this package depends on a device driver that could not be found.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 662 — The package to be staged has already been staged before with a different StageInPlace option.
Message
Fields
| Name | Description |
|---|---|
String | — |
Bool1 | — |
Bool2 | — |
Event ID 663 — The package that is being deprovisioned should be destaged, but the destaging operation was unable to be enqueued.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 664 — Error %1: The request cannot be processed because package %2 is in use.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 665 — For repair of package %1: starting %2 operation on package %3 (step %4 of %5).
Message
Fields
| Name | Description |
|---|---|
targetPackageFullNameForRepair | — |
deploymentOperation | — |
currentPackageFullName | — |
currentStepIndex | — |
numTotalSteps | — |
errorCode | — |
Event ID 666 — For repair of package %1: %2 operation on package %3 finished with result %6 (step %4 of %5).
Message
Fields
| Name | Description |
|---|---|
targetPackageFullNameForRepair | — |
deploymentOperation | — |
currentPackageFullName | — |
currentStepIndex | — |
numTotalSteps | — |
errorCode | — |
Event ID 667 — Registration of package %1 failed because packages cannot be updated as part of a batch registration.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 668 — Start Msixvc remediation for machine mutable package %1.
Message
Fields
| Name | Description |
|---|---|
packageFullName | — |
userSid | — |
hresult | — |
Event ID 669 — Msixvc remediation for machine mutable package %1 finished with result %3.
Message
Fields
| Name | Description |
|---|---|
packageFullName | — |
userSid | — |
hresult | — |
Event ID 670 — Start Msixvc remediation for user mutable package %1 for user %2.
Message
Fields
| Name | Description |
|---|---|
packageFullName | — |
userSid | — |
hresult | — |
Event ID 671 — Msixvc remediation for user mutable package %1 for user %2 finished with result %3.
Message
Fields
| Name | Description |
|---|---|
packageFullName | — |
userSid | — |
hresult | — |
Event ID 672 — Package %2 does not satisfy a dependency for package %1.
Message
Fields
| Name | Description |
|---|---|
DependentPackageName | — |
SupplierPackageName | — |
Reason | — |
Event ID 673 — Deployment %2 operation with main parameter %1 is hung and cancelled.
Message
Fields
| Name | Description |
|---|---|
MainPackageMoniker | — |
DeploymentOperation | — |
FailedDeploymentState | — |
Stack | — |
Event ID 674 — Removal of package %1 is deferred because it is currently in use.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 675 — Failed to mark package %1 for deferred removal with error %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Error | — |
Event ID 676 — Failed to clear deferred removal mark for package %1 with error %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Error | — |
Event ID 677 —
Fields
| Name | Description |
|---|---|
ProductID | — |
UpdateAttentionRequiredReason | — |
ErrorCode | — |
Event ID 677 — UUP update for product %1 needs attention.
Message
Fields
| Name | Description |
|---|---|
ProductID | — |
UpdateAttentionRequiredReason | — |
ErrorCode | — |
Event ID 678 —
Fields
| Name | Description |
|---|---|
MainPackageMoniker | — |
DeploymentOperation | — |
FailedDeploymentState | — |
Stack | — |
WaitChainInfo | — |
WerSubmitErrorCode | — |
Event ID 678 — Deployment %2 operation with main parameter %1 is hung and cancelled.
Message
Fields
| Name | Description |
|---|---|
MainPackageMoniker | — |
DeploymentOperation | — |
FailedDeploymentState | — |
Stack | — |
WaitChainInfo | — |
WerSubmitErrorCode | — |
Event ID 679 —
Fields
| Name | Description |
|---|---|
PackageList | — |
Event ID 679 — OnDemandRegisterPackageList %1.
Message
Fields
| Name | Description |
|---|---|
PackageList | — |
Event ID 680 —
Fields
| Name | Description |
|---|---|
Error | — |
PackageFullName | — |
OriginalPackageFullName | — |
Event ID 680 — OnDemandRegisterPackage error %1 on package %2 with original packagefullname %3.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageFullName | — |
OriginalPackageFullName | — |
Event ID 681 —
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 681 — Adding Staged entry for package %1 for System.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 682 —
Event ID 682 — All inbox manifest cache entries were deleted.
Message
Event ID 683 —
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 683 — Manifest cache for package %1 was reloaded; after reload, full name is now %2.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 684 —
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 684 — OnDemandRegisterPackage %1, framework not supported by OnDemandRegister operation found.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 697 —
Fields
| Name | Description |
|---|---|
MainPackageMoniker | — |
DeploymentOperation | — |
FailedDeploymentState | — |
Stack | — |
WaitChainInfo | — |
WerSubmitErrorCode | — |
Event ID 697 — Deployment %2 operation with main parameter %1 is hung and cancelled.
Message
Fields
| Name | Description |
|---|---|
MainPackageMoniker | — |
DeploymentOperation | — |
FailedDeploymentState | — |
Stack | — |
WaitChainInfo | — |
WerSubmitErrorCode | — |
Event ID 698 — Deployment %1 operation with target volume %5 on Package %2 from: %3 failed with error %4.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Path | 2 from. |
ErrorCode | — |
MountPoint | — |
TargetPlatform | — |
SystemVolume | — |
StorageId | — |
IsCentennial | — |
PackageType | — |
IsPackageEncrypted | — |
DeploymentOptions | — |
IsStreamingPackage | — |
IsInRelatedSet | — |
IsPackageUsingBDC | — |
MainPackageFamilyName | — |
CallingProcess | — |
IsInPlaceUpdate | — |
ErrorFileInfo | — |
DetailedMessageInfo | — |
RollbackErrorFileInfo | — |
RollbackDetailedMessageInfo | — |
IsOptional | — |
PackageFlags | — |
PackageFlags2 | — |
HasWin32alacarte | — |
HasFullTrust | — |
ExternalLocation | — |
PackageSourceUri | — |
PackageDisplayName | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 698
version: 0
level: 2
task: 3
opcode: 0
keywords: 1152991873351024641
time_created: '2023-11-06T06:22:44.338098+00:00'
event_record_id: 8
correlation:
ActivityID: 626F7C94-1079-0000-A09A-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Restricted
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentOperation: 12
PackageFullName: Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe
Path: ' '
ErrorCode: '0x80070032'
MountPoint: 'C:'
TargetPlatform: '0xffffffff'
SystemVolume: true
StorageId: \\?\Volume{7597d2a3-4404-4f99-b979-6233378a81bf}
IsCentennial: false
PackageType: '0x0'
IsPackageEncrypted: false
DeploymentOptions: '0x10000020'
IsStreamingPackage: false
IsInRelatedSet: false
IsPackageUsingBDC: false
MainPackageFamilyName: 'NULL'
CallingProcess: ''
IsInPlaceUpdate: '0x0'
ErrorFileInfo: indexingstatehandler.cpp,3328,80070032;appxlog.cpp,862,800706BA;indexingstatehandler.cpp,3329,80070032;indexingstatehandler.cpp,4036,80070032;indexingstatehandler.cpp,6315,80070032;deploymentmanager.cpp,276,80070032;deploymentrequest.cpp,2318,80070032;deploymentrequest.cpp,2568,80070032;errorhelpers.cpp,58,8007029C;errorhelpers.cpp,58,8007029C;deploymentrequest.cpp,3339,80073CF9;
DetailedMessageInfo: '[{GetErrorInfo reports there is no error object to return}];[{Deployment''s
currentstate (4) did progress far enough to pause. Staged state is (17)}];'
RollbackErrorFileInfo: 'NULL'
RollbackDetailedMessageInfo: 'NULL'
IsOptional: 0
PackageFlags: '0x0'
PackageFlags2: '0x0'
HasWin32alacarte: false
HasFullTrust: false
ExternalLocation: ''
PackageSourceUri: ''
PackageDisplayName: ''
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 699 — %1:%2 failed with error %3.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Error | — |
Event ID 700 — Unable to install %1 because the same package %2 is specified multiple times.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 701 — Unable to install %1 because %2 dependencies were specified.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Count | — |
MaxCount | — |
Event ID 702 — Windows cannot remove %1 because the current user does not have that package installed.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 703 — Windows cannot install %1 because this package has multiple dependencies on the same package %2.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 704 — Unable to install because of an unknown error %1 in determining which apps need to be closed.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 705 — Windows cannot deploy to path %1 of file system type %2.
Message
Fields
| Name | Description |
|---|---|
DeploymentPath | — |
FileSystemType | — |
Event ID 706 — error %2: Windows cannot access deployment target at %1.
Message
Fields
| Name | Description |
|---|---|
Path | — |
ErrorCode | — |
Event ID 707 — error %4: AppX Deployment %1 operation on package %2 from: %3 failed.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Path | — |
ErrorCode | — |
Event ID 708 — Deployment %1 operation rejected on package %2 from: %3 install request because the Local System account is not allowed to perform this operation.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Path | — |
Event ID 709 — Rejecting a request to register from %1 because the manifest is not in the package root.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 710 — The AppModel version could not be read from the registry.
Message
Event ID 711 — Rejecting a request to register from %1 because the files are on a network share.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 712 — Windows cannot perform the %1 operation because it could not find %2 in the repository.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageMoniker | — |
Event ID 713 — Windows cannot register %1 because this bundle was passed in as dependency package.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 714 — Windows cannot register the bundle %1 because the specified value from the DeploymentOptions enumeration is DevelopmentMode.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 715 — Windows cannot install from %1 because the AllResources DeploymentOption has been set and this package is not a bundle.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 716 — Unable to install bundle %2 because it does not have an appropriate application package for %1 architecture.
Message
Fields
| Name | Description |
|---|---|
Architecture | — |
path | — |
Event ID 717 — Windows cannot remove %1 because the PreserveApplicationData flag can only be used on a package that was deployed in development mode.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 718 — Failed to initialize PLM with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 719 — Deployment was cancelled after failure with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 720 — Failed with error %1 to reset machine register state in the State Repository database for package %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 721 — The specified package full name %1 is not eligible for a StageUserDataAsync call.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 722 — StageUserDataAsync cannot be called for package %1 which was deployed in development mode.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 723 — Windows cannot install package %1 because this package declares mismatched Windows versions.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
RequestedVersionMajor | — |
RequestedVersionMinor | — |
RequestedVersionAppModel | — |
OSVersionMajor | — |
OSVersionMinor | — |
OSVersionAppModel | — |
Event ID 724 — Windows cannot install package %1 because this package declares invalid Windows versions.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
RequestedVersionMajor | — |
RequestedVersionMinor | — |
RequestedVersionAppModel | — |
OSVersionMajor | — |
OSVersionMinor | — |
OSVersionAppModel | — |
Event ID 725 — Windows cannot find the main package manifest in the bundle file.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
Event ID 726 — Windows cannot find the resource package manifest in the bundle file.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
Event ID 727 — error %2: Unable to relaunch app %1 after the app was serviced.
Message
Fields
| Name | Description |
|---|---|
ApplicationUserModelId | — |
ErrorCode | — |
Event ID 728 — error %2: Unable to notify pre-launch service for app %1 install/uninstall.
Message
Fields
| Name | Description |
|---|---|
ApplicationUserModelId | — |
ErrorCode | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 728
version: 0
level: 3
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T22:29:22.627616+00:00'
event_record_id: 7667
correlation:
ActivityID: 59A0D65F-1037-0002-2BF3-A0593710DA01
execution:
process_id: 5296
thread_id: 5800
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
ApplicationUserModelId: Microsoft.WindowsTerminal_8wekyb3d8bbwe!App
ErrorCode: '0x80070015'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 729 — Unable to install %1 because %2 framework dependencies were specified.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Count | — |
MaxCount | — |
Event ID 730 — Unable to install %1 because %2 resource dependencies were specified.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Count | — |
MaxCount | — |
Event ID 731 — The check for how %1 applies to user %2 returned %3.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
SID | — |
ApplicabilityState | — |
Event ID 732 — The check for how %1 applies to user %2 failed with %3.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
SID | — |
ErrorCode | — |
ErrorFileInfo | — |
DetailedMessageInfo | — |
Event ID 733 — Invalid dependencies were specified.
Message
Event ID 734 — Package Manager aborted the %1 operation because an invalid argument was passed: %2.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
Argument | — |
Event ID 735 — Windows cannot install package %1 because it has version %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
PackageVersion | — |
PackageVersion2 | — |
Event ID 736 — Windows cannot move package %1 because it is a development mode package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 737 — Windows cannot move package %1 because it is a resource package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 738 — Windows cannot move package %1 because it is part of the system.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 739 — Windows cannot move package %1 because it needs to be reinstalled first.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 740 — Windows cannot move package %1 because the current user does not have the package installed.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 741 — Windows cannot move package %1 because a more recent version of the family is staged for the user to update.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 742 — Windows cannot move package %1 because other versions of the family are installed for other users.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 743 — Windows cannot move package %1 because it is a framework.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 744 — Package %1 is already on the target volume, so it will not be moved.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 745 — Windows cannot install package %1 because another package in the family is installed on a different volume.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 746 — Windows cannot install package %1 to volume %2 with media ID %3 because the volume is offline.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 747 — Windows cannot install package %1 to volume %2 with media ID %3 because framework packages can only be installed to the system volume.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 748 — Windows cannot move package %1 to volume %2 with media ID %3 because the volume is offline.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 749 — Windows cannot move package %1 from volume %2 with media ID %3 because the volume is offline.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 750 — Volume %2 with media ID %3 is offline.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 751 — Windows failed to undo changes with error code %1 to package %2.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 752 — Windows failed to update the mounted folder of package %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
FileName | — |
ErrorCode | — |
Event ID 753 — Windows failed to move package %1 to the MovedPackages location.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
FileName | — |
ErrorCode | — |
Event ID 754 — Windows failed to create a mounted folder for package %1 to location %2.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
FileName | — |
ErrorCode | — |
Event ID 755 — Windows cannot install app data for package %1 to volume %2 with media ID %3 because the volume is offline.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 756 — Windows cannot install app data for package %1 to volume %2 with media ID %3 because it is already installed to volume %4 with media ID %5.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DestinationPath | — |
DestinationMediaID | — |
SourcePath | — |
SourceMediaID | — |
Event ID 757 — Windows cannot move package %1 because it is in an invalid XAP state: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
XapState | — |
Event ID 758 — Windows cannot install package %1, because this operating system only supports apps built using the Windows 10 and greater universal application pl...
Message
Fields
| Name | Description |
|---|---|
PackageFamilyName | — |
Event ID 759 — Failed creating preview tiles for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 760 — Failed creating the canonical PRI file for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 761 — Preview tiles created for package %1.
Message
Fields
| Name | Description |
|---|---|
AppId | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 761
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T23:49:15.802971+00:00'
event_record_id: 9315
correlation:
ActivityID: E4DB489E-1037-0000-8A5A-E2E43710DA01
execution:
process_id: 6656
thread_id: 9272
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
AppId: DropboxInc.Dropbox_186.4.6207.0_x86__wkt425jdc3sga
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 762 — RemoveDefaultPackages uninstall override policy successfully removed package %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 763 — Windows cannot install package %1 because the package is currently paused.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 764 — Windows cannot install package %1 because it is missing a phone product ID.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 765 — Windows cannot install package %1 to volume %2 with media ID %3 because it is not supported on this filesystem.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 766 — Failed to create PackageInUseHelper.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 767 — Failed to set optional package in used by deployment.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 768 — Failed committing %1 transaction for preview tile generation.
Message
Fields
| Name | Description |
|---|---|
TileStore | — |
ErrorCode | — |
Event ID 769 — Could not update related set %2 because %1 is missing in %3.
Message
Fields
| Name | Description |
|---|---|
MissingPackageFamily | — |
CurrentlyInstalledPackages | — |
PackagesToBeInstalled | — |
Event ID 770 — Invalid bundle %1 contains multiple main or optional packages %2, %3 registered for a user.
Message
Fields
| Name | Description |
|---|---|
BundlePackageFullName | — |
MainOrOptionalPackageFullName1 | — |
MainOrOptionalPackageFullName2 | — |
Event ID 771 — Could not find the path %1 in the State Repository database.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
Event ID 772 — Re-indexing package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 773 — Setting status for package %1, so that it is re-registered before next launch.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 774 — Marking paused package %1 as staged in the State Repository database, since its payload was found to be complete.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 775 — Related set %2 is not ready for registration because %1 is missing in %3.
Message
Fields
| Name | Description |
|---|---|
MissingPackageFamily | — |
CurrentlyInstalledPackages | — |
PackagesToBeInstalled | — |
Event ID 776 — Windows failed to cleanup path %2 for package %1 with error %3.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
FileName | — |
ErrorCode | — |
Event ID 777 — Windows cannot install package %1 because this package is not compatible with the device.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 778 — Windows cannot install package %1 because this package is not compatible with the device.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
deviceFamilyName | — |
RequestedVersionMajor | — |
RequestedVersionMinor | — |
RequestedVersionBuild | — |
RequestedVersionRevision | — |
OSVersionMajor | — |
OSVersionMinor | — |
OSVersionBuild | — |
OSVersionRevision | — |
Event ID 779 — Windows cannot install non-preinstalled package %1 to volume %2 with media ID %3 because the volume is the Preinstalled Apps volume.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 780 — Windows cannot move package %1 from volume %2 with media ID %3 because the volume is the Preinstalled Apps volume.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 781 — Windows cannot move package %1 to volume %2 with media ID %3 because the volume is the Preinstalled Apps volume.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 782 — error %4: AppX Deployment %1 operation on package %2 from: %3 failed.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Path | — |
ErrorCode | — |
Event ID 783 — Windows cannot remove package %1 from volume %2 with media ID %3 because the volume is the Preinstalled Apps volume.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
MediaID | — |
Event ID 784 — Failed initializing preview tile generation for user %1.
Message
Fields
| Name | Description |
|---|---|
UserSid | — |
ErrorCode | — |
Event ID 785 — Failed creating preview tiles for package %1 due to the package not being found in StateRepository.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | 1 due to the package not being found in StateRepository. Error. |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 785
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T22:33:02.491340+00:00'
event_record_id: 7867
correlation:
ActivityID: E4DB489E-1037-0003-EC5E-DBE43710DA01
execution:
process_id: 4660
thread_id: 5424
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
PackageName: Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe
ErrorCode: '0x80070490'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 786 — Appinstaller file %1 has specified UpdateBlocksActivation is true but defined ShowPrompt as false (or did not define ShowPrompt).
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 787 — Windows cannot remove %1 because the PreserveRoamableApplicationData flag cannot be used together with incompatible options.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 788 — ContainerDeployment error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 789 — Windows cannot move package %1 because it is staged in place and cannot be moved.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 790 — Windows cannot move package %1 because it is unsigned.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 791 — Windows cannot install package %1 because it is not a valid unsigned package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Event ID 792 — Windows cannot install package %1 because its publisher %3 is not in the unsigned namespace.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Publisher | — |
Event ID 793 — Windows cannot install package %1 because its publisher %3 is not in the signed namespace.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Publisher | — |
Event ID 794 — Windows cannot install package %1 because it must allow external content to be installed with an external location.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Event ID 795 — Windows cannot install package %1 because an unsigned package cannot provide a host runtime.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Publisher | — |
Event ID 796 — Windows cannot install package %1 because an unsigned package cannot include Executable activations.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Publisher | — |
Event ID 797 — Access denied.
Message
Fields
| Name | Description |
|---|---|
IntegrityLevel | — |
CallerPackageFullName | — |
Event ID 798 — Windows cannot install package %1 because an unsigned package must be a Main package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Event ID 799 — Windows cannot install package %1 because windows.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Event ID 800 — Creation of registry key: %1 failed with error: %2.
Message
Fields
| Name | Description |
|---|---|
RegistryKeyName | — |
ErrorCode | — |
Event ID 801 — Opening registry key: %1 failed with error: %2.
Message
Fields
| Name | Description |
|---|---|
RegistryKeyName | — |
ErrorCode | — |
Event ID 802 — Deletion of registry key: %1 failed with error: %2.
Message
Fields
| Name | Description |
|---|---|
RegistryKeyName | — |
ErrorCode | — |
Event ID 803 — Registry copy of tree for package: %1 failed with error: %2.
Message
Fields
| Name | Description |
|---|---|
RegistryKeyName | — |
ErrorCode | — |
Event ID 804 — Failed to read the value named %2 from registry key: %1 with error: %3.
Message
Fields
| Name | Description |
|---|---|
with_error | — |
RegistryKeyName | — |
ValueName | — |
ErrorCode | — |
Event ID 805 — Failed to write the value named %2 from registry key: %1 with error: %3.
Message
Fields
| Name | Description |
|---|---|
with_error | — |
RegistryKeyName | — |
ValueName | — |
ErrorCode | — |
Event ID 806 — Package(s) with the following package full names were not registered due to sideloading policy restrictions.
Message
Fields
| Name | Description |
|---|---|
PackageFullNames | — |
Event ID 807 — Creation of registry key: {RegistryKeyName} failed with error: {ErrorCode}.
Message
Fields
| Name | Description |
|---|---|
RegistryKeyName | — |
ErrorCode | — |
Event ID 808 — Deletion of registry key: %1 failed with error: %2.
Message
Fields
| Name | Description |
|---|---|
RegistryKeyName | Deletion of registry key. |
ErrorCode | failed with error. |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 808
version: 0
level: 3
task: 6
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:25:40.373414+00:00'
event_record_id: 6938
correlation:
ActivityID: F590C418-1079-0000-ACC5-90F57910DA01
execution:
process_id: 1900
thread_id: 1596
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
RegistryKeyName: Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\S-1-5-21-1992711665-1655669231-58201500-500
ErrorCode: '0x80070002'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 809 — Package(s) with the following package full names were not registered due to sideloading policy restrictions.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 811 — Unable to determine whether package %2 is an all user package with error: %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 812 — Unable to update all user store with package %2 with error: %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 813 — Successfully updated all user store with package %1.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 813
version: 0
level: 5
task: 6
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T22:40:02.099394+00:00'
event_record_id: 9209
correlation:
ActivityID: E4DB489E-1037-0001-7F66-DCE43710DA01
execution:
process_id: 4660
thread_id: 5424
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageMoniker: Microsoft.MicrosoftEdge.Stable_119.0.2151.44_neutral__8wekyb3d8bbwe
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 814 — Opening registry key: {RegistryKeyName}\\{RegistrySubKeyName} failed with error: {ErrorCode}.
Message
Fields
| Name | Description |
|---|---|
RegistryKeyName | — |
RegistrySubKeyName | — |
ErrorCode | — |
Event ID 815 — Creating registry key: %1\\%2 failed with error: %3.
Message
Fields
| Name | Description |
|---|---|
Creating_registry_key | — |
RegistryKeyName | — |
RegistrySubKeyName | — |
ErrorCode | — |
Event ID 816 — Failed to write the value named %3 with value %4 in registry key %1\\%2 failed with error: %3.
Message
Fields
| Name | Description |
|---|---|
RegistryKeyName | — |
RegistrySubKeyName | — |
ValueName | — |
ValueValue | — |
ErrorCode | — |
Event ID 817 — Package %1 was moved to the Deleted store after reaching the max number of deployment attempts with error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
Event ID 818 — Determining packages to be installed during logon for user.
Message
Fields
| Name | Description |
|---|---|
UserSid | Determining packages to be installed during logon for user. |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 818
version: 0
level: 5
task: 6
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T22:33:55.354709+00:00'
event_record_id: 9137
correlation:
ActivityID: E4DB489E-1037-0002-5D8A-DBE43710DA01
execution:
process_id: 4660
thread_id: 5424
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
UserSid: S-1-5-18
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 819 — The following packages will be installed.
Message
Fields
| Name | Description |
|---|---|
InstallPackageList | The following packages will be installed. |
EndOfLifePackageList | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 819
version: 0
level: 5
task: 6
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:25:51.764566+00:00'
event_record_id: 6939
correlation:
ActivityID: F590C418-1079-0002-BEC9-90F57910DA01
execution:
process_id: 1864
thread_id: 3472
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
InstallPackageList: 'Microsoft.Windows.CloudExperienceHost_10.0.22621.2361_neutral_neutral_cw5n1h2txyewy
Microsoft.BioEnrollment_10.0.19587.1000_neutral_neutral_cw5n1h2txyewy Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral_neutral_cw5n1h2txyewy
MicrosoftWindows.UndockedDevKit_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.UI.Xaml.CBS_8.2305.16002.0_neutral_neutral_8wekyb3d8bbwe
MicrosoftWindows.Client.Core_1000.22643.1000.0_x64__cw5n1h2txyewy MicrosoftWindows.Client.CBS_1000.22674.1000.0_x64__cw5n1h2txyewy
Microsoft.Windows.StartMenuExperienceHost_10.0.22621.2215_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.ShellExperienceHost_10.0.22621.2215_neutral_neutral_cw5n1h2txyewy
windows.immersivecontrolpanel_10.0.6.1000_neutral_neutral_cw5n1h2txyewy Microsoft.549981C3F5F10_3.2204.14815.0_neutral_~_8wekyb3d8bbwe
CanonicalGroupLimited.UbuntuonWindows_2004.2022.1.0_neutral_~_79rhkp1fndgsc Clipchamp.Clipchamp_2.2.8.0_neutral_~_yxz26nhyzhsrt
Microsoft.DesktopAppInstaller_2023.1005.18.0_neutral_~_8wekyb3d8bbwe Microsoft.GamingApp_2021.427.138.0_neutral_~_8wekyb3d8bbwe
Microsoft.GetHelp_10.2201.421.0_neutral_~_8wekyb3d8bbwe Microsoft.Getstarted_2021.2204.1.0_neutral_~_8wekyb3d8bbwe
Microsoft.HEIFImageExtension_1.0.43012.0_x64__8wekyb3d8bbwe Microsoft.HEVCVideoExtension_1.0.50361.0_x64__8wekyb3d8bbwe
Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe Microsoft.MicrosoftStickyNotes_4.2.2.0_neutral_~_8wekyb3d8bbwe
Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x86__8wekyb3d8bbwe
Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x86__8wekyb3d8bbwe
Microsoft.Paint_11.2308.30.0_neutral_~_8wekyb3d8bbwe Microsoft.PowerAutomateDesktop_10.0.3735.0_neutral_~_8wekyb3d8bbwe
Microsoft.RawImageExtension_2.1.30391.0_neutral_~_8wekyb3d8bbwe Microsoft.ScreenSketch_2022.2201.12.0_neutral_~_8wekyb3d8bbwe
Microsoft.SecHealthUI_1000.25873.9001.0_x64__8wekyb3d8bbwe Microsoft.StorePurchaseApp_12008.1001.113.0_neutral_~_8wekyb3d8bbwe
Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe Microsoft.UI.Xaml.2.7_7.2208.15002.0_x64__8wekyb3d8bbwe
Microsoft.UI.Xaml.2.7_7.2208.15002.0_x86__8wekyb3d8bbwe Microsoft.UI.Xaml.2.8_8.2306.22001.0_x64__8wekyb3d8bbwe
Microsoft.UI.Xaml.2.8_8.2306.22001.0_x86__8wekyb3d8bbwe Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x64__8wekyb3d8bbwe
Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x86__8wekyb3d8bbwe Microsoft.VCLibs.140.00_14.0.32530.0_x64__8wekyb3d8bbwe
Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe Microsoft.VP9VideoExtensions_1.0.50901.0_x64__8wekyb3d8bbwe
Microsoft.WebMediaExtensions_1.0.42192.0_neutral_~_8wekyb3d8bbwe Microsoft.WebpImageExtension_1.0.42351.0_x64__8wekyb3d8bbwe
Microsoft.Windows.Photos_21.21030.25003.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsAlarms_2022.2202.24.0_neutral_~_8wekyb3d8bbwe
Microsoft.WindowsCalculator_2021.2307.4.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsCamera_2022.2201.4.0_neutral_~_8wekyb3d8bbwe
Microsoft.WindowsFeedbackHub_2023.504.1552.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsNotepad_11.2307.27.0_neutral_~_8wekyb3d8bbwe
Microsoft.WindowsSoundRecorder_2021.2103.28.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsStore_22309.1401.2.0_neutral_~_8wekyb3d8bbwe
Microsoft.WindowsTerminal_3001.18.2822.0_neutral_~_8wekyb3d8bbwe Microsoft.Xbox.TCUI_1.23.28004.0_neutral_~_8wekyb3d8bbwe
Microsoft.XboxGameOverlay_1.47.2385.0_neutral_~_8wekyb3d8bbwe Microsoft.XboxGamingOverlay_2.622.3232.0_neutral_~_8wekyb3d8bbwe
Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe
MicrosoftCorporationII.QuickAssist_2022.414.1758.0_neutral_~_8wekyb3d8bbwe MicrosoftWindows.Client.WebExperience_423.23500.0.0_neutral_~_cw5n1h2txyewy
1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy
c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy
F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
Microsoft.AccountsControl_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.AsyncTextService_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe
Microsoft.CredDialogHost_10.0.19595.1001_neutral_neutral_cw5n1h2txyewy Microsoft.ECApp_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe
Microsoft.LockApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.MicrosoftEdgeDevToolsClient_10.0.22621.1_neutral__8wekyb3d8bbwe
Microsoft.Win32WebViewHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.AppRep.ChxApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.AssignedAccessLockApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.CallingShellApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.ContentDeliveryManager_10.0.22621.2361_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.NarratorQuickStart_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe
Microsoft.Windows.ParentalControls_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.PeopleExperienceHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.PinningConfirmationDialog_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.PrintQueueActionCenter_1.0.1.0_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.SecureAssessmentBrowser_10.0.22621.900_neutral_neutral_cw5n1h2txyewy
Microsoft.Windows.XGpuEjectDialog_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.WindowsAppRuntime.CBS_4000.1000.1727.0_x64__8wekyb3d8bbwe
Microsoft.XboxGameCallableUI_10.0.22621.1_neutral_neutral_cw5n1h2txyewy MicrosoftWindows.Client.FileExp_1000.22651.1000.0_x64__cw5n1h2txyewy
NcsiUwpApp_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy
Windows.PrintDialog_6.2.2.0_neutral_neutral_cw5n1h2txyewy '
EndOfLifePackageList: 'NULL'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 820 — Unable to determine packages to be installed during logon with error.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 821 — During-logon registration of package %2 for user %1 finished with result: %3; updating registry.
Message
Fields
| Name | Description |
|---|---|
UserSid | — |
MainPackageFullName | — |
ErrorCode | 1 finished with result. |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 821
version: 0
level: 5
task: 6
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T23:49:16.051896+00:00'
event_record_id: 9316
correlation:
ActivityID: E4DB489E-1037-0003-A7A1-E0E43710DA01
execution:
process_id: 10560
thread_id: 5420
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
UserSid: S-1-5-21-1992711665-1655669231-58201500-1000
MainPackageFullName: DropboxInc.Dropbox_186.4.6207.0_x86__wkt425jdc3sga
ErrorCode: '0x0'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 822 — Updating registry for package %2 completed with result: %1.
Message
Fields
| Name | Description |
|---|---|
Error | 2 completed with result. |
PackageMoniker | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 822
version: 0
level: 5
task: 6
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-05T23:49:16.055234+00:00'
event_record_id: 9317
correlation:
ActivityID: E4DB489E-1037-0003-A7A1-E0E43710DA01
execution:
process_id: 10560
thread_id: 5420
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
Error: '0x0'
PackageMoniker: DropboxInc.Dropbox_186.4.6207.0_x86__wkt425jdc3sga
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 823 — Unable to determine whether package %2 is an all user package with error: %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 824 — Windows cannot register the package %1 because Modern App can't be updated to Xap.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 825 — Windows cannot register the package %1 because Appx can't be updated to SL Lightup.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 826 — Windows cannot register the package %1 because there is mismatch in developer status for package registered with same PID.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 827 — Capability parsing started for the package {PackageName}.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 828 — error %4: AppX Deployment %1 operation on package %2 from: %3 failed.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
PackageFullName | — |
Path | — |
ErrorCode | — |
Event ID 829 — Could not retrieve decryption key from CLIP
Message
Event ID 830 — Move is blocked for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 831 —
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 832 — The downlevel package repository could not be accessed for package %1 (action=%2).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Action | — |
ErrorCode | — |
Event ID 833 — The package %1 was removed from the package repository because the package manifests are missing.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 834 — The package repository fix failed with error code %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 835 — The optional package %1 can't be installed because its main package dependency %2 is not installed.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 836 — The optional package %2 with dependency on main package %1 will also be removed.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 837 —
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 838 — Invalid End of Life package %1 will be ignored.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 839 — Skipping package %2 because its volume is offline or missing: %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 840 — The corresponding main package already has the same Application Id %1 as this optional package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 841 — Failed to Expand the environment strings, while creating the Merged Pri file for package:%2, with error :%1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 842 — Failed to create the Merged Pri file for package:%2 with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 843 — The optional package %2 has a FullTrust entry point which requires the main package %1 to have the runFullTrust capability which it does not have.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 844 — The optional package with centennial content %2 is not in a related set and it is required to be in a related set specified by the centennial main ...
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 845 — Windows can't provision the package %1 because it is an unsupported package type.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 845
version: 0
level: 2
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2022-03-04T08:49:09.116203+00:00'
event_record_id: 213
correlation:
ActivityID: ACBE470D-2FA4-0000-3550-BEACA42FD801
execution:
process_id: 2536
thread_id: 2800
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WIN-TKC15D7KHUR
security:
user_id: S-1-5-18
event_data:
PackageMoniker: Microsoft.MicrosoftEdge.Stable_86.0.622.38_neutral__8wekyb3d8bbwe
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 846 — Windows can't provision the package %1 because it is not installed on a system volume.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 847 — Windows can't provision the package %1 because its dependency main package is not provisioned.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 848 — Package %1 is end of life and can no longer be installed.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 849 — Target user for deployment %1 operation on package %2 was changed to DefaultAccount.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
Package | — |
OriginalUser | — |
Event ID 850 — Redirection to DefaultAccount was attempted for deployment operation %1 on package %2 and blocked because the user is not a device owner.
Message
Fields
| Name | Description |
|---|---|
Result | — |
DeploymentOperation | — |
Package | — |
OriginalUser | — |
ErrorCode | — |
Event ID 851 — Windows can't upgrade to package %1 due to a different architecture when policy for the package requires same-architecture upgrades.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 852 — Scheduled task %2 could not be enabled due to error: %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 853 — Error %1 in package folding: cannot create hardlinking file in main package folder for file %2, because both package %3 and package %4 have this file.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
String3 | — |
Event ID 854 — Successfully added the following uri(s) to be processed.
Message
Fields
| Name | Description |
|---|---|
Path | Successfully added the following uri(s) to be processed. |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 854
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:17.526216+00:00'
event_record_id: 6800
correlation:
ActivityID: 626F7C94-1079-0000-B9AE-6F627910DA01
execution:
process_id: 1532
thread_id: 1660
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
Path: ' C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_423.23500.0.0_neutral_~_cw5n1h2txyewy\AppxMetadata\AppxBundleManifest.xml
C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_423.23500.0.0_x64__cw5n1h2txyewy\AppxManifest.xml'
message: ''
Sigma Rules
- Remote AppX Package Downloaded from File Sharing or CDN Domain
Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain. - AppX Located in Known Staging Directory Added to Deployment Pipeline
Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory. - AppX Located in Uncommon Directory Added to Deployment Pipeline
Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations.
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 855 — Finished resolving action lists.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | Finished resolving action lists. DeploymentRequest action lists. |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 855
version: 0
level: 4
task: 4
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:22:35.475271+00:00'
event_record_id: 5859
correlation:
ActivityID: 626F7C94-1079-0003-2383-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageMoniker: ' addPackageList: MicrosoftWindows.UndockedDevKit_10.0.22621.1_neutral_neutral_cw5n1h2txyewy'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 856 — Getting registration status of package family %2 for user %1.
Message
Fields
| Name | Description |
|---|---|
UserSid | — |
PackageFamilyName | — |
Event ID 857 — Getting registration status of package family %2 completed with result: %1.
Message
Fields
| Name | Description |
|---|---|
statusFound | — |
Status | .(statusFound. |
Error | — |
PackageFamilyName | — |
FoundState | — |
ErrorCode | — |
Event ID 858 — Failed to determine the type of current user's profile with error %1.
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 859 — Failed to check for a developer license with error %1.
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 860 — Failed to notify RDS of recovery trigger with error %1.
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 861 — The InstallStub option cannot be used with package %2 because it is not a bundle containing a stub.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 862 — The package %2 has a host runtime dependency resolving to package %3 containing full trust content which requires the main package %1 to have the r...
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
PackageMoniker3 | — |
Event ID 863 — Orphaned AppDataVolume %1 no longer exists, and is now replaced with the package volume %2.
Message
Fields
| Name | Description |
|---|---|
OrphanedAppDataVolume | — |
MitigatedAppDataVolume | — |
Event ID 864 — The preinstalled app %1 will be destaged because it is not applicable for the region of the device.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 865 — Path missing for package %1, will be ignored.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 866 — Windows cannot install package %1 because it must be installed with an external location.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 866
version: 0
level: 2
task: 3
opcode: 0
keywords: 4611756387171565569
time_created: '2023-11-06T06:22:44.277802+00:00'
event_record_id: 6088
correlation:
ActivityID: 626F7C94-1079-0000-A09A-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageName: Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe
DeploymentOptions: '0x10000020'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 867 — Windows cannot install package %1 because it is already installed with a different external location.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
DeploymentOptions | — |
Event ID 868 — Windows failed to evaluate the preinstalled apps' region applicability with error %1 at step %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 869 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 870 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 871 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 872 —
Fields
| Name | Description |
|---|---|
String | — |
Bool1 | — |
Bool2 | — |
Event ID 900 — Windows cannot install package %1 because existing app package %2 uses the same mutable package directory %3.
Message
Fields
| Name | Description |
|---|---|
PackageFullname | — |
ExitingPackageFullname | — |
MutablePackageDirectory | — |
Event ID 926 — Cannot provision the related set.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 927 — Cannot provision the related set.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 928 — Cannot provision the related set.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
PackageMoniker2 | — |
Event ID 929 — The package family name from the.
Message
Fields
| Name | Description |
|---|---|
PackageFamilyNameOne | — |
PackageFamilyNameTwo | — |
Event ID 930 — The appinstaller uri %2 is already being used by another package and cannot be applied to package %1 until the association is removed.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
Event ID 931 — Update check on applications configured for AppInstaller file background updates completed successfully for the following package families.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 932 — Package SystemRegistration state changed across upgrade: Incoming package %1 has state %2, Outgoing package %3 has state %4.
Message
Fields
| Name | Description |
|---|---|
incomingPackageFullName | — |
processIncomingPackage | — |
outgoingPackageFullName | — |
outgoingPackageIsSystemRegistered | — |
Event ID 933 —
Fields
| Name | Description |
|---|---|
allowListRule | — |
regExErrorCode | — |
regExErrorDescription | — |
Event ID 933 — Evaluation of allow list of package family names for BlockNonAdminUserInstall policy failed for rule %1 with error code %2.
Message
Fields
| Name | Description |
|---|---|
allowListRule | — |
regExErrorCode | — |
regExErrorDescription | — |
Event ID 934 —
Fields
| Name | Description |
|---|---|
AppxPoliciesKeyOpened | — |
EnableMsixAllowedZonesExists | — |
EnableMsixAllowedZones | — |
MsixAllowedZonesKeyOpened | — |
ErrorCode | — |
Event ID 935 —
Fields
| Name | Description |
|---|---|
UriSecurityZone | — |
ErrorCode | — |
Event ID 936 —
Fields
| Name | Description |
|---|---|
Uri | — |
UriSecurityZone | — |
DefaultPolicyApplied | — |
ErrorCode | — |
Event ID 937 —
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 938 —
Fields
| Name | Description |
|---|---|
Uri | — |
UriSecurityZone | — |
DefaultSmartScreenCheckPolicyApplied | — |
ErrorCode | — |
Event ID 1001 — Started activating the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1002 — Finished activating the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1003 — Started deactivating the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1004 — Finished deactivating the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1005 — Started updating the {PackageName} package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1006 — Finished updating the {PackageName} package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1007 — Started parsing the %1 package manifest.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1008 — Finished parsing the %1 package manifest.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1009 — Started conflict resolution on %1 package for extension %2 and %3 key.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
CategoryName | — |
KeyName | — |
Event ID 1010 — Finished conflict resolution on %1 package for extension %2 and %3 key.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
CategoryName | — |
KeyName | — |
Event ID 1011 — Started an evaluate of the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1012 — Finished an evaluate of the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1013 — Started removing the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1014 — Finished removing the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1015 — Started an evaluate update of the {PackageName} package for the {ExtensionName} extension.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ExtensionName | — |
Event ID 1016 — Finished an evaluate update of the {PackageName} package for the {ExtensionName} extension.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ExtensionName | — |
Event ID 1017 — Started committing the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1018 — Finished committing the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1019 — Started a call to dependency manager
Message
Event ID 1020 — Finished a call from dependency manager with error.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1021 — Starting to setup the firewall for the %1 package with %2 binaries.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
BinaryCount | — |
Event ID 1022 — Completed setting up the firewall for the %1 package with %2 error code.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 1023 — Starting to setup device capabilities for the %1 package with %2 friendly-name device capabilities.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
CapabilityCount | — |
Event ID 1024 — Completed setting up the device capabilities for the %1 package with %2 error code.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 1025 — Starting to create the AppContainer profile for the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1026 — Completed creating the AppContainer profile for the %1 package with %2 error code.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 1029 — Starting to create the repository metadata for the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1030 — Completed creating the repository metadata for the %1 package by %2 error code.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 1031 — About to call CreateDataSource with %1.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
Event ID 1032 — Finished call from CreateDataSource for %1.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
Event ID 1033 — Begin delta diff calculation for package update: %1 staging to %2 with base package in %3.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
PackageFolder | — |
PackageFolderOld | — |
Event ID 1034 — End delta diff calculation for package update: %1 staging to %2 with base package in %3.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
PackageFolder | — |
PackageFolderOld | — |
Event ID 1035 — Begin range request, file name %1, offset %2, size %3.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Offset | — |
Size | — |
Event ID 1036 — Range request progress: file name %1, offset %2, size %3.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Offset | — |
Size | — |
Event ID 1037 — End range request for file name %1, offset %2, size %3.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Offset | — |
Size | — |
Event ID 1038 — PreAllocateFile Start for file %1 size %2.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
FileSize | — |
Event ID 1039 — PreAllocateFile End for file %1 size %2.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
FileSize | — |
Event ID 1040 — AppxRequestHandler::Run Start for package %1 staging to %2.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
PackageFolder | — |
Event ID 1041 — AppxRequestHandler::Run End for Package %1 staged to %2.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
PackageFolder | — |
Event ID 1042 — PreAllocatePackage Start: %1 staging to %2.
Message
Fields
| Name | Description |
|---|---|
PreAllocatePackage_Start | — |
PackageUri | — |
PackageFolder | — |
Event ID 1043 — PreAllocatePackage End: %1 staging to %2.
Message
Fields
| Name | Description |
|---|---|
PreAllocatePackage_End | — |
PackageUri | — |
PackageFolder | — |
Event ID 1044 — AppxRequestHandler::Run Start for package update: %1 staging to %2 with base package in %3.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
PackageFolder | — |
PackageFolderOld | — |
Event ID 1045 — AppxRequestHandler::Run End for package update: %1 staging to %2 with base package in %3.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
PackageFolder | — |
PackageFolderOld | — |
Event ID 1046 — PreAllocatePackage Start for package update: %1 staging to %2 with base package in %3.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
PackageFolder | — |
PackageFolderOld | — |
Event ID 1047 — PreAllocatePackage End for package update: %1 staging to %2 with base package in %3.
Message
Fields
| Name | Description |
|---|---|
PackageUri | — |
PackageFolder | — |
PackageFolderOld | — |
Event ID 1048 — Starting to delete the de-staged package files.
Message
Event ID 1049 — Deleted de-staged package files with result %1.
Message
Fields
| Name | Description |
|---|---|
ReturnValue | — |
Event ID 1051 — Starting to delete the AppContainer profile for the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 1052 — Completed deleting the AppContainer profile for the %1 package with %2 error code.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 1061 — Started an evaluate of the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1062 — Finished an evaluate of the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1063 — Started removing the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1064 — Finished removing the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1065 — Started committing the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1066 — Finished committing the request for the %1 extension.
Message
Fields
| Name | Description |
|---|---|
ExtensionName | — |
Event ID 1101 —
Event ID 1102 —
Event ID 1103 —
Event ID 1104 —
Event ID 1107 —
Event ID 1108 —
Event ID 1109 —
Event ID 1110 —
Event ID 1113 —
Event ID 1114 —
Event ID 1115 —
Event ID 1116 —
Event ID 1117 —
Event ID 1118 —
Event ID 1119 —
Event ID 1120 —
Event ID 1121 —
Event ID 1122 —
Event ID 1125 —
Event ID 1126 —
Event ID 1127 —
Event ID 1128 —
Event ID 1129 —
Event ID 1130 —
Event ID 1131 —
Event ID 1132 —
Event ID 1133 —
Event ID 1134 —
Event ID 1135 —
Event ID 1136 —
Event ID 1137 —
Event ID 1138 —
Event ID 1139 —
Event ID 1140 —
Event ID 1141 —
Event ID 1142 —
Event ID 1143 —
Event ID 1144 —
Event ID 1145 —
Event ID 1146 —
Event ID 1147 —
Event ID 1148 —
Event ID 1149 —
Event ID 1150 —
Event ID 1151 —
Event ID 1152 —
Event ID 1153 —
Event ID 1154 —
Event ID 1155 —
Event ID 1156 —
Event ID 1157 —
Event ID 1158 —
Event ID 1161 —
Event ID 1162 —
Event ID 1163 —
Event ID 1164 —
Event ID 1165 —
Event ID 1166 —
Event ID 1169 —
Event ID 1170 —
Event ID 1171 —
Event ID 1172 —
Event ID 1173 —
Event ID 1174 —
Event ID 1175 —
Event ID 1176 —
Event ID 1177 —
Event ID 1178 —
Event ID 1179 —
Event ID 1180 —
Event ID 1181 —
Event ID 1182 —
Event ID 1183 —
Event ID 1184 —
Event ID 1185 —
Event ID 1186 —
Event ID 1187 —
Event ID 1188 —
Event ID 1189 —
Event ID 1190 —
Event ID 1191 —
Event ID 1192 —
Event ID 1199 —
Event ID 1200 —
Event ID 1201 —
Event ID 1202 —
Event ID 1203 —
Event ID 1204 —
Event ID 1205 —
Event ID 1206 —
Event ID 1207 —
Event ID 1208 —
Event ID 1209 —
Event ID 1210 —
Event ID 1211 —
Event ID 1212 —
Event ID 1215 —
Event ID 1216 —
Event ID 1217 —
Event ID 1218 —
Event ID 1219 —
Event ID 1220 —
Event ID 1223 — Hardlink candidates - Current package %1, target package %2, current file path %3, target file path %4, current file size %5, target file size %6.
Message
Fields
| Name | Description |
|---|---|
CurrentPackageFullName | — |
TargetPackageFullName | — |
CurrentFilePath | — |
TargetFilePath | — |
CurrentFileSize | — |
TargetFileSize | — |
Event ID 1224 —
Event ID 1225 —
Event ID 1226 —
Event ID 1227 —
Event ID 1228 — ApplyAppxSharedFileAclsStart for path %1.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 1229 — ApplyAppxSharedFileAclsStop completed with result %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1230 — These hardlinks did not have packages in repository.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 1231 —
Event ID 1232 —
Event ID 1233 —
Event ID 1234 —
Event ID 1235 — Msixvc staging session method %2 started for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
Event ID 1236 — Msixvc staging session method %2 finished for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Path | — |
Event ID 1237 —
Event ID 1238 —
Event ID 1301 — Starting to delete the de-staged package files in directory %1.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 1302 — Deleted de-staged package files with result %1.
Message
Fields
| Name | Description |
|---|---|
ReturnValue | — |
Event ID 1303 —
Fields
| Name | Description |
|---|---|
PackageFullName | — |
PackageKey | — |
Count | — |
SizeKB | — |
HardLinkedCount | — |
HardLinkedSizeKB | — |
DurationMS | — |
Event ID 1304 —
Fields
| Name | Description |
|---|---|
PackageFullName | — |
PackageKey | — |
Count | — |
UncompressedSizeKB | — |
CompressedSizeKB | — |
DurationMS | — |
Event ID 2000 —
Fields
| Name | Description |
|---|---|
packageFullName | — |
returnCode | — |
Event ID 2001 —
Fields
| Name | Description |
|---|---|
packageFullName | — |
returnCode | — |
Event ID 3000 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3001 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3002 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3003 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3004 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3005 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3006 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3007 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3008 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3009 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3010 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3011 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3012 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3013 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3014 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3015 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3016 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3017 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3018 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3019 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3020 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3021 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3022 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3023 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3024 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3025 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3026 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3027 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3028 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3029 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3030 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3031 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3032 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3033 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3034 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3035 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3036 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3037 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3038 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3039 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3040 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3041 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3042 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3043 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3044 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3045 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3046 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3047 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3048 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3049 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3060 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3061 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3062 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3063 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3064 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3065 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3066 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3067 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3068 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3069 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3090 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3091 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3092 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3093 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3094 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3095 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3096 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3097 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3098 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3099 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3110 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3111 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3114 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3115 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3118 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3119 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3130 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3131 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3132 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3133 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3134 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3135 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3136 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3137 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3138 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3139 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3140 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3141 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3142 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3143 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3144 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3145 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3146 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3147 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3148 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3149 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3150 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3151 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3152 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3153 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3154 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3155 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3156 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3157 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3158 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3159 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3160 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3161 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3162 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3163 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3164 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3165 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3166 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3167 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3168 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3169 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3170 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3171 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3172 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3173 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3174 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3175 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3176 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3177 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3178 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3179 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3180 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3181 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3182 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3183 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3184 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3185 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3186 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3187 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3188 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3189 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3190 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3191 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3192 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3193 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3194 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3195 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3196 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3197 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3198 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3199 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3200 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3201 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3202 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3203 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3204 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3205 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3206 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3207 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3208 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3209 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3210 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3211 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3220 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3221 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3222 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3223 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3224 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3225 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3226 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3227 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3228 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3229 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3230 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3231 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3232 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3233 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3234 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3235 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3236 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3237 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3238 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3239 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3240 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3241 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3242 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3243 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3244 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3245 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3246 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3247 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3248 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3249 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3250 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3251 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3252 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3253 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3254 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3255 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3256 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3257 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3258 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3259 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3260 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3261 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3262 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3263 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3264 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3265 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3266 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3267 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3268 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3269 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3270 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3271 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3272 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3273 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3274 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3275 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3276 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3277 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3278 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3279 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3280 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3281 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3300 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3301 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3302 — warning {ErrorCode}: The following error occurred while performing Indexed DB cleanup when removing the package: {PackageName} ({ErrorText}).
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 3303 — Started loading the AppX Extensions DLL.
Message
Event ID 3304 — Finished loading the AppX Extensions DLL.
Message
Event ID 3305 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3306 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3307 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3308 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3309 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3310 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3311 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3312 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3313 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3314 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3315 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3316 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3320 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3321 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3324 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3325 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3326 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3327 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3328 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3329 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3330 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3331 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3332 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3333 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3334 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3335 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3336 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3337 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3338 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3339 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3360 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3361 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3362 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3363 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3364 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3365 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3366 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3367 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3368 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3369 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3370 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3371 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3372 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3373 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3380 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3381 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3382 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3383 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3384 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3385 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3386 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3387 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3388 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3389 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3390 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3391 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3392 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3393 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3394 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3395 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3396 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3397 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3398 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3399 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3400 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3401 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3402 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3403 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3404 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3405 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3406 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3407 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3408 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3409 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3410 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3411 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3420 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3421 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3424 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3425 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3440 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3441 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3442 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3443 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3444 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3445 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3446 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3447 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3448 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3449 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3500 —
Event ID 3501 —
Event ID 3502 —
Event ID 3503 —
Event ID 3600 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3601 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3610 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3611 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3612 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3613 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3614 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3615 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3616 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3617 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3618 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3619 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3620 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3621 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3622 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3623 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3624 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3625 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3626 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3627 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3628 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3629 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3650 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3651 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3652 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3653 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3654 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3655 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3656 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3657 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3658 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3659 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3660 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3661 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3662 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3663 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3664 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3665 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3666 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3667 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3668 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3669 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3670 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3671 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3672 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3673 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3674 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3675 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3676 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3677 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3678 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3679 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3700 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3701 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3702 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3703 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3704 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3705 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3706 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3707 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3708 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3709 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3800 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3801 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3802 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3803 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3804 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3805 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3806 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3807 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3808 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3809 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3830 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3831 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3832 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3833 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3834 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3835 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3836 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3837 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3838 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3839 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3860 —
Event ID 3861 —
Event ID 3950 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3951 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3952 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3953 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3954 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3955 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3956 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3957 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3958 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3959 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3960 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3961 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3962 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3963 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3964 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3965 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3966 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3967 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3968 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 3969 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4000 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4001 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4002 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4003 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4004 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4005 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4006 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4007 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4008 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4009 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4050 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4051 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4052 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4053 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4054 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4055 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4056 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4057 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4058 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4059 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4100 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4101 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4102 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4103 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4104 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4105 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4106 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4107 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4108 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4109 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4150 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4151 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4152 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4153 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4160 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4161 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4162 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4163 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4164 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4165 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4166 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4167 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4168 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4169 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4200 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4201 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4202 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4203 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4204 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4205 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4206 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4207 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4208 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4209 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4250 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4251 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4252 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4253 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4254 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4255 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4256 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4257 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4258 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4259 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4300 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4301 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4302 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4303 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4304 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4305 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4306 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4307 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4308 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 4309 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 5000 — Successfully registered the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 5001 — Initialization of the Visual Elements extension was started.
Message
Event ID 5002 — Initialization of the visual elements extension was completed with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 5003 — Uninitialization of the Visual Elements extension was started.
Message
Event ID 5004 — Uninitialization of the Visual Elements extension completed with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 5005 — The Visual Elements extension started to commit the deployment for package %1.
Message
Fields
| Name | Description |
|---|---|
IncomingPackageName | — |
Event ID 5006 — The Visual Elements extension completed committing the deployment for package %1 with error %2.
Message
Fields
| Name | Description |
|---|---|
IncomingPackageName | — |
ErrorCode | — |
Event ID 5007 — The Visual Elements extension started to revert the deployment.
Message
Event ID 5008 — The Visual Elements extension completed reverting the deployment.
Message
Event ID 5009 — The Visual Elements extension started installing package %1.
Message
Fields
| Name | Description |
|---|---|
IncomingPackageName | — |
Event ID 5010 — The Visual Elements extension completed installation of %1 package with error %2.
Message
Fields
| Name | Description |
|---|---|
IncomingPackageName | — |
ErrorCode | — |
Event ID 5011 — The Visual Elements extension started updating package %1 over existing package %2.
Message
Fields
| Name | Description |
|---|---|
IncomingPackageName | — |
OutgoingPackageName | — |
Event ID 5012 — The Visual Elements extension completed updates to package %1 over existing package %2 with error %3.
Message
Fields
| Name | Description |
|---|---|
IncomingPackageName | — |
OutgoingPackageName | — |
ErrorCode | — |
Event ID 5013 — The Visual Elements extension started removing package %1.
Message
Fields
| Name | Description |
|---|---|
OutgoingPackageName | — |
Event ID 5014 — The Visual Elements extension completed removal of package %1 with error %2.
Message
Fields
| Name | Description |
|---|---|
OutgoingPackageName | — |
ErrorCode | — |
Event ID 5020 — The Notifications extension initialized app %1 with settings %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Settings | — |
Event ID 5021 — App %1 was not initialized for notifications.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 5022 — error %1: The Notifications extension was unable to connect to the Push Notification Platform.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 5023 — The Notifications extension started periodic update manifest processing.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 5024 — The Notifications extension stopped periodic update manifest processing.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 5025 — The Notifications extension found URI %2 with a periodic update recurrence of %3 in the manifest (%1).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Uri | — |
PeriodicUpdateRecurrence | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 5025
version: 0
level: 5
task: 2
opcode: 0
keywords: 4611686018427387906
time_created: '2023-11-06T01:42:39.772299+00:00'
event_record_id: 9476
correlation:
ActivityID: E4DB489E-1037-0002-14D2-F0E43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
PackageFullName: SpotifyAB.SpotifyMusic_zpdnekdrzrea0!Spotify
Uri: https://spclient.wg.spotify.com/v1/live-tile-xml?region={region}&language={language}
PeriodicUpdateRecurrence: halfHour
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5026 — The Notifications extension started periodic update temporary registration.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 5027 — The Notifications extension stopped periodic update temporary registration with HRESULT %2 (%1).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Result | — |
Event ID 5028 — The Notifications extension started periodic update registration.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 5028
version: 0
level: 5
task: 2
opcode: 1
keywords: 4611686018427387906
time_created: '2023-11-06T01:42:41.200135+00:00'
event_record_id: 9477
correlation:
ActivityID: E4DB489E-1037-0002-14D2-F0E43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
PackageFullName: SpotifyAB.SpotifyMusic_zpdnekdrzrea0!Spotify
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5029 — The Notifications extension stopped periodic update registration with HRESULT %2 (%1).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Result | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 5029
version: 0
level: 5
task: 2
opcode: 2
keywords: 4611686018427387906
time_created: '2023-11-06T01:42:41.590510+00:00'
event_record_id: 9478
correlation:
ActivityID: E4DB489E-1037-0002-14D2-F0E43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
PackageFullName: SpotifyAB.SpotifyMusic_zpdnekdrzrea0!Spotify
Result: 0
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5040 — %1: Cannot delete splash screen information from the registry for package %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
Event ID 5041 — %1: Cannot install or update package %2 because the splash screen information could not be written to the registry.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
Event ID 5042 — %1(%2,%3): error %4: Cannot install, update, or uninstall package %5 because the splash screen element could not be parsed from the package's manif...
Message
Fields
| Name | Description |
|---|---|
Filename | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 5043 — %1(%2,%3): error %4: Cannot install or update package %5 because the splash screen image [%6] cannot be located.
Message
Fields
| Name | Description |
|---|---|
Filename | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ImagePath | — |
Event ID 5044 — %1(%2,%3): error %4: Cannot install or update package %5 because a splash screen image for the current application context cannot be identified.
Message
Fields
| Name | Description |
|---|---|
Filename | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 5060 — error %1: Adding a tile failed with unexpected error.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 5063 — Adding a tile failed because the VisualElements element is missing for app %1.
Message
Fields
| Name | Description |
|---|---|
ErrorContext | — |
Event ID 5064 — Adding a tile failed because element '.
Message
Fields
| Name | Description |
|---|---|
ErrorContext1 | — |
ErrorContext2 | — |
Event ID 5065 — Adding a tile failed because color value '.
Message
Fields
| Name | Description |
|---|---|
ErrorContext1 | — |
ErrorContext2 | — |
Event ID 5066 — Adding a tile failed because there are multiple apps with ID %1 defined.
Message
Fields
| Name | Description |
|---|---|
ErrorContext | — |
Event ID 5067 — Adding a tile failed because the required element '.
Message
Fields
| Name | Description |
|---|---|
ErrorContext1 | — |
ErrorContext2 | — |
Event ID 5068 — Adding a tile failed because the resource '.
Message
Fields
| Name | Description |
|---|---|
ErrorContext | — |
Event ID 5069 — Adding a tile failed because file '.
Message
Fields
| Name | Description |
|---|---|
ErrorContext1 | — |
ErrorContext2 | — |
Event ID 5070 — Adding a tile failed because changes could not be committed to file '.
Message
Fields
| Name | Description |
|---|---|
ErrorContext1 | — |
ErrorContext2 | — |
Event ID 5071 — Removing a tile failed because file '.
Message
Fields
| Name | Description |
|---|---|
ErrorContext1 | — |
ErrorContext2 | — |
Event ID 5073 — Adding a tile failed because app %1 is defined to provide tile notifications on lock screen but does not have a WideLogo attribute defined.
Message
Fields
| Name | Description |
|---|---|
ErrorContext | — |
Event ID 5074 — Adding a tile failed because app %1 is defined to provide either notifications on the lockscreen or background tasks, but not both.
Message
Fields
| Name | Description |
|---|---|
ErrorContext | — |
Event ID 5090 — error %1: The Visual Elements extension failed.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 5091 — error %1: The Visual Elements extension failed while processing the SplashScreen element in the package manifest.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 5092 — error %1: The Visual Elements extension failed while processing the Notification element.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 5093 —
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ApplicationUserModelId | — |
ErrorCode | — |
Event ID 5093 — error %3: Unable to notify WpnService for app %2 during install/update of %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ApplicationUserModelId | — |
ErrorCode | — |
Event ID 5101 — error %1: Cannot create registry key or value %2 for the %3 package.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Location | — |
PackageName | — |
Event ID 5102 — error %1: Cannot delete registry key or value %2 for the %3 package.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Location | — |
PackageName | — |
Event ID 5104 — %1(%2,%3): error: Cannot register the %4 package because the %5 verb occurs more than once.
Message
Fields
| Name | Description |
|---|---|
File | — |
Line | — |
Column | — |
Package | — |
Verb | — |
Event ID 5105 — %1(%2,%3): error: Cannot register the %4 package because the open verb is reserved for use with file type association.
Message
Fields
| Name | Description |
|---|---|
File | — |
Line | — |
Column | — |
Package | — |
Event ID 5106 — %1(%2,%3): error: Cannot register the %4 package because this app handles AutoPlay events that require the removable-storage capability.
Message
Fields
| Name | Description |
|---|---|
File | — |
Line | — |
Column | — |
Package | — |
Event ID 5200 — The system app data folder already exists.
Message
Event ID 5201 — The system app data key already exists.
Message
Event ID 5202 — The application data local root folder already exists.
Message
Event ID 5203 — The application data roaming root folder already exists.
Message
Event ID 5204 — The application data temp root folder already exists.
Message
Event ID 5205 — The application data settings store already exists.
Message
Event ID 5206 — The application data user profile packages folder already exists.
Message
Event ID 5207 — The application data user profile packages key already exists.
Message
Event ID 5208 — Creation of the system app data folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5209 — Creation of the system app data key failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5210 — Creation of the application data local root folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5211 — Creation of the application data roaming root folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5212 — Creation of the application data temp root folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5213 — Creation of the application data settings store failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5214 — Creation of the application data user profile packages key failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5215 — Creation of the application data user profile packages folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5216 — Successfully created the system app data folder.
Message
Event ID 5217 — Successfully created the system app data key.
Message
Event ID 5218 — Successfully created the application data local root folder.
Message
Event ID 5219 — Successfully created the application data roaming root folder.
Message
Event ID 5220 — Successfully created the application data temp root folder.
Message
Event ID 5221 — Successfully created the application data settings store.
Message
Event ID 5222 — Successfully created the application data user profile packages key
Message
Event ID 5223 — Successfully created the application data user profile packages folder
Message
Event ID 5224 — Error while deleting file %1.
Message
Fields
| Name | Description |
|---|---|
filename | — |
Error | — |
Event ID 5225 — Error while deleting Directory %1.
Message
Fields
| Name | Description |
|---|---|
filename | — |
Error | — |
Event ID 5226 — Error while deleting system app data key.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5227 — Application data remains from a previous uninstall.
Message
Event ID 5228 — No application data remains from a previous uninstall.
Message
Event ID 5229 — Local, Roaming and Temp application data roots already exist.
Message
Event ID 5230 — Error while deleting the existing application data.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5231 — Successfully deleted any existing application data.
Message
Event ID 5232 — Error while acquiring roaming mutex.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5233 — State DEH failed to load existing application data settings store.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5234 — Creation of the application data root folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5235 — Successfully created the application data root folder.
Message
Event ID 5236 — The application data root folder already exists.
Message
Event ID 5237 — Creation of application data settings folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5238 — Successfully created application data settings folder.
Message
Event ID 5239 — The application data settings folder already exist.
Message
Event ID 5240 — Copying the settings apphive into the application data settings folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5241 — Successfully copied the settings store into the application data settings folder.
Message
Event ID 5242 — Access Denied error while deleting the system app data key.
Message
Event ID 5243 — Trying to reset the ACL's on the system app data key failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5244 — Successfully ACL'ed the system app data key.
Message
Event ID 5245 — The system app data folder does not exist.
Message
Event ID 5246 — The system app data key does not exist.
Message
Event ID 5247 — Creation of the application data synchronization lock failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5248 — The application data lock already exists.
Message
Event ID 5249 — The application data lock does not exist.
Message
Event ID 5250 — Verification of the application data synchronization lock failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5251 — Successfully created application data lock.
Message
Event ID 5252 — An internal error occurred with error %1.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5253 — The application data local cache root folder already exists.
Message
Event ID 5254 — Creation of the application data local cache root folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5255 — Successfully created the application data local cache root folder.
Message
Event ID 5256 — error %1: Windows failed to signal registration change for the %2 package.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 5257 — error %1: Windows failed to persist backup eligibility for the %2 package.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 5258 — error %1: Windows failed to unregister the state lock for the %2 package.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 5259 — error %1: Windows failed to add the marker when unable to unistall the state for the %2 package.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 5260 — The app data folder already exists.
Message
Event ID 5261 — The app data folder does not exist.
Message
Event ID 5262 — Successfully created the app data folder.
Message
Event ID 5263 — Creation of the app data folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5264 — The AC folder already exists.
Message
Event ID 5265 — The AC folder does not exist.
Message
Event ID 5266 — Successfully created the AC folder.
Message
Event ID 5267 — Creation of the AC folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5268 — The Publisher Root folder already exists.
Message
Event ID 5269 — Creation of the Publisher Root folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5270 — Successfully created the Publisher Root folder.
Message
Event ID 5271 — The %1 Publisher Shared folder already exists.
Message
Fields
| Name | Description |
|---|---|
filename | — |
Event ID 5272 — Creation of the %1 Publisher Shared folder failed with error code : %2.
Message
Fields
| Name | Description |
|---|---|
filename | — |
Error | — |
Event ID 5273 — Successfully created the %1 Publisher Shared folder.
Message
Fields
| Name | Description |
|---|---|
filename | — |
Event ID 5274 — The Publishers folder already exists.
Message
Event ID 5275 — Creation of the Publishers folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5276 — Successfully created the Publishers folder.
Message
Event ID 5277 — Application data local root folder is a mounted folder that has no target.
Message
Event ID 5278 — Application data roaming root folder is a mounted folder that has no target.
Message
Event ID 5279 — Application data temp root folder is a mounted folder that has no target.
Message
Event ID 5280 — Application data local cache root folder is a mounted folder that has no target.
Message
Event ID 5281 — Successfully created the secure system app data folder.
Message
Event ID 5282 — Creation of the secure system app data folder failed with error code.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5283 — The secure system app data folder already exists.
Message
Event ID 5284 — The secure system app data folder does not exist.
Message
Event ID 5285 — Set package status for %2 failed with error code : %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 5286 — Package AppData for %2 unavailable, error code : %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 5287 — Fetching of policy data for package %1 failed with error code: %2.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 5288 — Clearing of policy data for package %1 failed with error code: %2.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 5289 — Writing Setting %3 (index %5) with value %4 for package %2 failed with error code: %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
SettingName | — |
SettingValue | — |
Index | — |
Event ID 5290 — FixAppLoadHive encountered sharing violation.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5301 — %1(%2,%3): error %4: Cannot register the %5 package because the '%6' file type association is reserved for system use.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 5302 — %1: error %2: Error during removal of the %3 package because the '%4' registry key could not be deleted.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
ErrorText | — |
ExtendedData | — |
Event ID 5325 — %1(%2,%3): error %4: Cannot register the %5 package because the '%6' content type association is reserved for system use.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 5350 — %1(%2,%3): error %4: Cannot register the %5 package because the '%6' protocol is reserved for system use.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 5351 — %1(%2,%3): error %4: Cannot register the %5 package because the '%6' protocol custom progid is not valid for this package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 5401 — error %2: Windows cannot create the AppContainer profile for the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 5402 — error %2: Windows cannot set up the firewall for the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 5403 — error %2: Windows cannot set up the device capabilities for the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 5405 — error %3: Windows cannot create the repository metadata for the %1 package with %2 apps.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ApplicationCount | — |
ErrorCode | — |
Event ID 5406 — %1(%2,%3): error %4: Cannot map the %6 well-known device name to a device interface GUID for the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
DeviceName | — |
Event ID 5407 — error %2: Windows cannot delete the AppContainer profile for the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 5411 — {FileName}({LineNumber};{ColumnNumber}): error {ErrorCode}: The ApplicationContentUriRules rule {NavigationDomainRule} for the {ApplicationId} Appl...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
NavigationDomainRule | — |
ApplicationId | — |
PackageName | — |
Event ID 5412 — {FileName}({LineNumber};{ColumnNumber}): error {ErrorCode}: The OSMaxVersionTested element must be greater than or equal to the OSMinVersion elemen...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 5413 — error %2: Failed to install package %1 because the firewall service is not running.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 5414 — error %2: Failed to remove package %1 because the firewall service is not running.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 5415 — error %2: Failed to update package %1 because the firewall service is not running.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 5417 — error %2: Unable to install the framework package %1 because its manifest contains capabilities.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 5418 —
Fields
| Name | Description |
|---|---|
FirewallErrorCode | — |
ScmManagerErrorCode | — |
BfeServiceOpenErrorCode | — |
FirewallServiceOpenErrorCode | — |
BfeServiceCurrentState | — |
BfeServiceExitCode | — |
BfeServiceSpecificExitCode | — |
FirewallServiceCurrentState | — |
FirewallServiceExitCode | — |
FirewallServiceSpecificExitCode | — |
Event ID 5418 — error %1: FWOpenPolicyStore failed.
Message
Fields
| Name | Description |
|---|---|
FirewallErrorCode | — |
ScmManagerErrorCode | — |
BfeServiceOpenErrorCode | — |
FirewallServiceOpenErrorCode | — |
BfeServiceCurrentState | — |
BfeServiceExitCode | — |
BfeServiceSpecificExitCode | — |
FirewallServiceCurrentState | — |
FirewallServiceExitCode | — |
FirewallServiceSpecificExitCode | — |
Event ID 5500 — %1 : error %4 : Cannot register the %5 package because the specified resource language '%6' is not a valid language.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 5501 — %1 : error %4 : Cannot register the %5 package because there are no free merge indices for the main package '%6'.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 5502 — %1 : error %4 : Cannot register the %5 package because there was a merge failure with the following file: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 5503 — %1 : error %4 : Cannot register the %5 package family because there was a failure setting permissions on the ResourceConfig registry key.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 5504 — {PackageName} : {FilePath} : {Message}.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
Message | — |
Event ID 5505 — %1 : %2 : %3.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
Message | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 5505
version: 0
level: 5
task: 0
opcode: 0
keywords: 4611686018428436480
time_created: '2023-11-05T22:33:55.921171+00:00'
event_record_id: 9154
correlation:
ActivityID: E4DB489E-1037-0002-8E8A-DBE43710DA01
execution:
process_id: 4660
thread_id: 5424
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageName: CanonicalGroupLimited.UbuntuonWindows_2004.2022.1.0_x64__79rhkp1fndgsc
FilePath: C:\Program Files\WindowsApps\CanonicalGroupLimited.UbuntuonWindows_2004.2022.1.0_x64__79rhkp1fndgsc\microsoft.system.package.metadata\S-1-5-21-1992711665-1655669231-58201500-1000-MergedResources-0.pri
Message: Linked user-specific merged PRI file
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5506 — %1 : %2 : %3.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
Message | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 5506
version: 0
level: 5
task: 0
opcode: 0
keywords: 4611686018428436480
time_created: '2023-10-25T21:56:08.304376+00:00'
event_record_id: 4295
correlation:
ActivityID: D6B877D5-078C-0001-D025-B9D68C07DA01
execution:
process_id: 4436
thread_id: 1864
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDevEval
security:
user_id: S-1-5-18
event_data:
PackageName: CanonicalGroupLimited.UbuntuonWindows_2004.2022.1.0_x64__79rhkp1fndgsc
FilePath: C:\Program Files\WindowsApps\CanonicalGroupLimited.UbuntuonWindows_2004.2022.1.0_x64__79rhkp1fndgsc\microsoft.system.package.metadata\resources.1068029b.pri
Message: Created shared merged PRI file
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5507 — %1 : %2 : %3.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
Message | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 5507
version: 0
level: 5
task: 0
opcode: 0
keywords: 4611686018428436480
time_created: '2023-11-06T01:42:41.839233+00:00'
event_record_id: 9482
correlation:
ActivityID: E4DB489E-1037-0002-14D2-F0E43710DA01
execution:
process_id: 17796
thread_id: 20072
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
PackageName: SpotifyAB.SpotifyMusic_1.222.982.0_x64__zpdnekdrzrea0
FilePath: C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.222.982.0_x64__zpdnekdrzrea0\microsoft.system.package.metadata\Resources.????????.pri
Message: No shared merged files found
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5508 — %1 : %2 : %3.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
Message | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 5508
version: 0
level: 5
task: 0
opcode: 0
keywords: 4611686018428436480
time_created: '2023-11-05T22:33:55.039075+00:00'
event_record_id: 9126
correlation:
ActivityID: E4DB489E-1037-0002-E889-DBE43710DA01
execution:
process_id: 4660
thread_id: 5424
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageName: Clipchamp.Clipchamp_2.2.8.0_neutral__yxz26nhyzhsrt
FilePath: C:\Program Files\WindowsApps\Clipchamp.Clipchamp_2.2.8.0_neutral__yxz26nhyzhsrt\microsoft.system.package.metadata\resources.1abb87d3.pri
Message: Deleted
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5509 — %1 : %2 : err=%3 : %4.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
ErrorCode | — |
Message | — |
Event ID 5510 — %1 : %2 : err=%3 : %4.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
ErrorCode | — |
Message | — |
Event ID 5511 — %1 : %2 : err=%3 : %4.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
ErrorCode | — |
Message | — |
Event ID 5512 — %1 : %2 : %3.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
Message | — |
Event ID 5513 — %1 : %2 : err=%3 : %4.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
ErrorCode | — |
Message | — |
Event ID 5514 — %1 : %2 : err=%3 : %4.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
FilePath | — |
ErrorCode | — |
Message | — |
Event ID 5600 — An internal error occurred with error {ReturnVal}.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5601 — An internal error occurred with error {ReturnVal}.
Message
Fields
| Name | Description |
|---|---|
ReturnVal | — |
Event ID 5602 — Scheduling roaming sync for package %2 failed with error %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 5603 — Deferred roaming data acquisition for package %1, will block its activation for roaming data.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 5604 — Deferred roaming data acquisition for package %1, will not block activation for roaming data.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 5605 — Roaming data status for package %2 is %1.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 6201 — error %1: Windows cannot register the package because the %2 ActivatableClassID of the %3 contract was not found.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ActivatableClassIdentifier | — |
ContractID | — |
Event ID 6202 — error %1: Windows cannot register the package because the logo file name is missing.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6203 — error %1: Windows cannot register the package because the %2 ActivatableClassID of the %3 contract is not an exe server.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ActivatableClassIdentifier | — |
ContractID | — |
Event ID 6204 — error %1: Windows cannot register the package because the %2 ActivatableClassID of the %3 contract is not marked with the ActivateAsPackage attribute.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ActivatableClassIdentifier | — |
ContractID | — |
Event ID 6205 — error %1: Windows cannot register the package because an ActivatableClassID with the same name already exists: '%2'.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ActivatableClassIdentifier | — |
Event ID 6206 — error %1: Windows cannot register the package because an ActivatableClassID was previously declared with the same name: '%2'.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ActivatableClassIdentifier | — |
Event ID 6207 — error %1: Windows cannot register the package because the %2 ActivatableClassID name is empty or too long.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ActivatableClassIdentifier | — |
Event ID 6208 — error %1: Windows cannot register the package because the %2 ActivatableClassID is invalid.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ActivatableClassIdentifier | — |
Event ID 6209 — error %1: Windows cannot register the package because a Windows Runtime server with the same name already exists: '%2'.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ServerName | — |
Event ID 6210 — error %1: Windows cannot register the package because a Windows Runtime server with the same name was previously declared: '%2'.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ServerName | — |
Event ID 6211 — error %1: Windows cannot register the package because the %2 Windows Runtime server name is empty or too long.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ServerName | — |
Event ID 6212 — error %1: Windows cannot register the package because the %2 Windows Runtime server name is invalid.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ServerName | — |
Event ID 6213 — error %1: Windows cannot register the package because an error occured when registering the %2 Windows Runtime server.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ServerName | — |
Event ID 6215 — error %1: Windows cannot register the %2 package because the Activatable Class %3 does not contain a valid DllPath.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
ActivatableClassIdentifier | — |
Event ID 6216 — error %1: Windows cannot register the %2 package because the Activatable Class %3 does not have a valid Threading Model.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
ActivatableClassIdentifier | — |
Event ID 6217 — error %1: Windows cannot register the package because two or more attributes share the name '%2'.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
AttributeName | — |
Event ID 6218 — error %1: Windows cannot register the package because an attribute on the ActivatableClass is invalid.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6219 — error %1: Windows cannot register the package because an attribute on the ActivatableClass is empty or too long.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6220 —
Event ID 6221 — error %1: Windows cannot register the package because the ProxyStub CLSID %2 is defined in two or more DLLs.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
CLSID | — |
Event ID 6222 — error %1: Windows cannot register the package because a ProxyStub CLSID is already associated with interface %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
InterfaceIdentifier | — |
Event ID 6223 — error %1: Windows cannot register the package because the publisher name is missing.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6224 — error %1: Windows cannot register the package because the display name is mising.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6225 — error %1: Windows cannot register the package because the description is missing.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6226 — error %1: Windows cannot register the package because the %2 contract identifier is empty or too long.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
ServerName | — |
Event ID 6227 — error %1: Windows cannot register the package because of low memory.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6228 — error %1: Windows cannot register the package because of an internal error or low memory.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6229 — error %1: Windows cannot register the %2 package because of an internal error or low memory.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 6230 — error %1: Windows cannot register the %2 package because of an internal error or low memory.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 6231 — error %1: Windows cannot register the package because of an internal error or low memory.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6400 — error {ErrorCode}: Failed to install Game {PackageMoniker}.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageMoniker | — |
Event ID 6401 — error {Error}: Failed to create Internal Game State.
Message
Fields
| Name | Description |
|---|---|
Error | — |
Event ID 6402 — error {ErrorCode}: Failed to remove Game {PackageMoniker}.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageMoniker | — |
Event ID 6403 — The extension content from the package manifest is {Message}.
Message
Fields
| Name | Description |
|---|---|
Message | — |
Event ID 6404 — The game definition file container file path is {Message}.
Message
Fields
| Name | Description |
|---|---|
Message | — |
Event ID 6405 — error {Error}: game definition file container file not found.
Message
Fields
| Name | Description |
|---|---|
Error | — |
Event ID 6406 — error {Error}: Failed to validate extension content.
Message
Fields
| Name | Description |
|---|---|
Error | — |
Event ID 6407 — error {ErrorCode}: Game {PackageMoniker} is already installed.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageMoniker | — |
Event ID 6408 — error {ErrorCode}: Game {PackageMoniker} is not installed.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageMoniker | — |
Event ID 6409 — error {Error}: Could not create a GameExplorer object.
Message
Fields
| Name | Description |
|---|---|
Error | — |
Event ID 6410 — error {Error}: Failed to validate input parameters.
Message
Fields
| Name | Description |
|---|---|
Error | — |
Event ID 6411 — error {Error}: Internal state not set.
Message
Fields
| Name | Description |
|---|---|
Error | — |
Event ID 6412 — error {Error}: Invalid Access.
Message
Fields
| Name | Description |
|---|---|
Error | — |
Event ID 6500 — error %1: windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6501 — error %1: windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6502 — error %1: windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6503 — error %2: windows.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
ErrorCode | — |
Event ID 6504 — error %2: windows.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
ErrorCode | — |
Event ID 6505 — error %1: windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 6550 — %1(%2,%3): error %4: Cannot register %5 package because the following error was encountered while trying to open and evaluate the %6 certificate to...
Message
Fields
| Name | Description |
|---|---|
File | — |
Line | — |
Column | — |
ErrorCode | — |
Package | — |
Content | — |
StoreName | — |
ErrorCodeDescription | — |
Event ID 6551 — %1(%2,%3): warning: While registering %4 package, a SelectionCriteria element without attributes was found.
Message
Fields
| Name | Description |
|---|---|
File | — |
Line | — |
Column | — |
Package | — |
Event ID 6552 — %1(%2,%3): error %4: Cannot register %5 package because the following error was encountered while parsing the Certificates element: %6.
Message
Fields
| Name | Description |
|---|---|
File | — |
Line | — |
Column | — |
ErrorCode | — |
Package | — |
ErrorCodeDescription | — |
Event ID 6800 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while parsing the %7 extension: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 6801 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while registering the %7 extension: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 6802 — Cannot restore the %1 extension because it was not found in the %2 package.
Message
Fields
| Name | Description |
|---|---|
UniqueKey | — |
PackageName | — |
Event ID 6803 — error %4: The following error occured while preparing the %1 extension in the %2 package for update or removal: %3.
Message
Fields
| Name | Description |
|---|---|
Category | — |
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 6900 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while parsing the package: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 6901 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while parsing the %7 Extension element: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 6902 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while parsing the %7 application: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 6903 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while registering the %7 activatable class: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 6904 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while registering the %7 contract ID: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 6905 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while parsing the %7 Action element: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 6906 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while parsing the %7 service ID: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 6907 — %1(%2,%3): error %4: Cannot register the %5 package because the following error was encountered while parsing the %7 Extension element: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
ExtendedData | — |
Event ID 6908 — Version %1 selected for Proxy App package.
Message
Fields
| Name | Description |
|---|---|
PackageVersion | — |
Event ID 7001 — error %3: Cannot register the %1 package because the following error was encountered while creating the %2 package dependency file: %4.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FileName | — |
ErrorCode | — |
ErrorText | — |
Event ID 7002 — error %3: Cannot register the %1 package because the following error was encountered while removing the %2 package dependency file.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FileName | — |
ErrorCode | — |
ErrorText | — |
Event ID 7003 — error {ErrorCode} : Cannot register the {PackageFullName} package because the following error was encountered while creating the {Key}\{Subkey} pac...
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageFullName | — |
Key | — |
Subkey | — |
ErrorText | — |
Event ID 7004 — error {ErrorCode}: Cannot register the {PackageFullName} package because the following error was encountered while removing the {Key}\{Subkey} pack...
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageFullName | — |
Key | — |
Subkey | — |
ErrorText | — |
Event ID 7005 — error %3: Failed to enqueue a request for deferred file deletion for %1 package because the following error was encountered for the %2 package depe...
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FileName | — |
ErrorCode | — |
ErrorText | — |
Event ID 7006 — error {ErrorCode}: Cannot register the {PackageFullName} package because the following error was encountered while opening the HKEY_CURRENT_USER_LO...
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageFullName | — |
ErrorText | — |
Event ID 7007 — error {ErrorCode}: Cannot register the {PackageFullName} package because the following error was encountered while enumerating to remove the {Key}\...
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageFullName | — |
Key | — |
Subkey | — |
ErrorText | — |
Event ID 7008 — Upstream dependency scan for the %1 package found the %2 package (PackageKey=%3).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
UpstreamDependentPackageFullName | — |
UpstreamDependentPackageKey | — |
Event ID 7009 — error %3: Cannot register the %1 package because the following error was encountered while creating the %2 package dependency file: %4.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FileName | — |
ErrorCode | — |
ErrorText | — |
Event ID 7010 — error %3: Cannot register the %1 package because file error was encountered while removing the %2 package dependency file.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
FileName | — |
ErrorCode | — |
ErrorText | — |
Event ID 7011 — error %2: Cannot process the %1 package because the following error was encountered while retrieving its package state: %3.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
ErrorText | — |
Event ID 7012 — Started creating the Dependency Mini Repository for the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 7013 — Finished creating the Dependency Mini Repository for the %1 package.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 7014 — error %6: Cannot process the %1 package because the following error was encountered while retrieving the %3 property for the value '%4': %7.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
PackageIndex | — |
PropertyId | — |
Value | — |
Type | — |
ErrorCode | — |
ErrorText | — |
Event ID 7015 — error %7: Cannot process the %2 application in the %1 package because the following error was encountered while retrieving the %4 property for the ...
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
PackageRelativeApplicationId | — |
ApplicationIndex | — |
PropertyId | — |
Value | — |
Type | — |
ErrorCode | — |
ErrorText | — |
Event ID 7016 — error %3: Cannot retrieve file usage for the %2 package dependency file in the %1 package because the following error was encountered: %4.
Message
Fields
| Name | Description |
|---|---|
ProcessingPackageFullName | — |
FileName | — |
ErrorCode | — |
ErrorText | — |
Event ID 7017 — error %3: Failure processing %1 package because %2 package dependency file is in use by %6 processes.
Message
Fields
| Name | Description |
|---|---|
ProcessingPackageFullName | — |
FileName | — |
ErrorCode | — |
ErrorText | — |
ProcessIndex | — |
ProcessCount | — |
ProcessId | — |
Event ID 7018 — error %3: Failure processing %1 package because %2 package dependency file is in use by %6 processes.
Message
Fields
| Name | Description |
|---|---|
ProcessingPackageFullName | — |
FileName | — |
ErrorCode | — |
ErrorText | — |
ProcessIndex | — |
ProcessCount | — |
ProcessId | — |
ApplicationUserModelId | — |
PackageFullName | — |
ExecutableName | — |
UserSID | — |
UserDomain | — |
UserName | — |
SessionId | — |
Event ID 7019 — Started creating the Dependency Mini Repository for the %1 incoming package.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 7020 — Finished creating the Dependency Mini Repository for the %1 incoming package.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 7021 — Started updating the Dependency Mini Repository for the %1 upstream package.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 7022 — Finished updating the Dependency Mini Repository for the %1 upstream package.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 7023 — Started removing the Dependency Mini Repository for the %1 outgoing package.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 7024 — Finished removing the Dependency Mini Repository for the %1 outgoing package.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 7025 — %2: Package runtime information %1 failed to load (processid=%3).
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
ProcessId | — |
ErrorText | — |
PackageFullName | — |
Event ID 7026 — error %2: Cannot process the %1 package because the following error was encountered while retrieving its package status: %3.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
ErrorText | — |
Event ID 7027 — Upstream dependency scan for the %1 package found the %2 package (PackageKey=%3).
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
UpstreamDependentPackageFullName | — |
UpstreamDependentPackageKey | — |
Event ID 7028 — Removed {PackageMoniker} package from HKEY_CURRENT_USER_LOCAL_SETTINGS families key because it is no longer referenced in the state repository.
Message
Fields
| Name | Description |
|---|---|
PackageMoniker | — |
Event ID 7029 — error %3: Cannot update the DependencyMiniRepository (DMR) file.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 7100 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 7101 — %1(%2,%3): error %4: Cannot register the %5 package because the extension is missing an EntryPoint or StartPage attribute.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7102 — %1(%2,%3): error %4: Cannot register the %5 package because the ServerName attribute is invalid.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7103 — %1(%2,%3): error %4: Cannot register the %5 package because the Executable attribute is invalid.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7104 — %1(%2,%3): error %4: Cannot register the %5 package because ServerName and Executable attribute are mutually exclusive.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7105 — %1(%2,%3): error %4: Cannot register the %5 package because a task of this type requires a custom background task host.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7106 — %1(%2,%3): error %4: Cannot register the %5 package because ServerName and ResourceGroup attribute are mutually exclusive.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7107 — %1(%2,%3): error %4: Cannot register the %5 package because Executable cannot be specified when no EntryPoint is specified.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7108 — %1(%2,%3): error %4: Cannot register the %5 package because ResourceGroup must match application ResourceGroup when no EntryPoint is specified.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7109 — error %3: Cannot register the %1 package while processing the default background task due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 7110 — %1(%2,%3): error %4: Cannot register the %5 package because ResourceGroup must not match application ResourceGroup when SupportsMultipleInstances i...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7111 — %1(%2,%3): error %4: Cannot register the %5 package because Executable cannot be specified when SupportsMultipleInstances is true.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7112 — %1(%2,%3): error %4: Cannot register the %5 package because EntryPoint must be specified when SupportsMultipleInstances is true.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7113 — %1(%2,%3): error %4: Cannot register the %5 package because StartPage must be specified when SupportsMultipleInstances is true.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7200 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 7250 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 7300 — %1 : Failed to fire WNF notification for Device Setup for the package %2 after uninstall.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
Event ID 7301 — %1 : Failed to fire WNF notification for Device Setup for the package %2 after install.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
Event ID 7302 — %1 : Failed to switch to system context before firing the WNF notification(s) for Device Setup for incoming package %2 and outgoing package %3.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
IncomingPackageName | — |
OutgoingPackageName | — |
Event ID 7400 — %2: Package runtime information %1 is corrupted (address=%5, size=%3, offset=%4, section=%6, processid=%7).
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
Size | — |
Offset | — |
HeaderAddr | — |
Section | — |
ProcessId | — |
Event ID 7401 — %2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6).
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
Size | — |
HeaderAddr | — |
Section | — |
ProcessId | — |
Event ID 7402 — %2: Package runtime information %1 contains conflicting data (address=%5, size=%3, offset=%4, section=%6, processid=%7).
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
Size | — |
Offset | — |
HeaderAddr | — |
Section | — |
ProcessId | — |
Event ID 7403 — %2: Package runtime information %1 contains unexpected data (address=%5, size=%3, offset=%4, section=%6, processid=%7).
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
Size | — |
Offset | — |
HeaderAddr | — |
Section | — |
ProcessId | — |
Event ID 7404 — %2: Package runtime information %1 failed to load (processid=%3).
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
ProcessId | — |
Event ID 7405 — Package runtime information %1 failed to load because exception %2 occurred.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ExceptionCode | — |
Event ID 7406 — %2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6).
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
Size | — |
HeaderAddr | — |
ApplicationUserModelId | — |
ProcessId | — |
Event ID 7407 — %2: Application identity not accessible while loading package runtime information %1 (address=%4, size=%3, processid=%5).
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
Size | — |
HeaderAddr | — |
ProcessId | — |
Event ID 7408 — Package runtime information %1 failed to refresh because the following error %2 occurred in operation type %3.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
ErrorCode | — |
Type | — |
ProcessId | — |
Event ID 7500 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 7501 — %1(%2,%3): error %4: Cannot register the %5 package because the Executable attribute is invalid.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7600 — %1 : Failed to load the object that will clean up the association between the current user and package %2.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 7601 — %1 : Failed to complete cleaning up the association between the current user and package %2.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PackageMoniker | — |
Event ID 7700 — APPX manifest DeviceCapability %6: missing required Device element.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
DeviceCapabilityName | — |
Event ID 7701 — %2: Cannot register package %1 because of an error in DeviceCapability %6: %6 is not a supported Name.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
DeviceCapabilityName | — |
Event ID 7702 — %2: Cannot register package %1 because of an error in DeviceCapability %6: Device %7 missing required Function element.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
DeviceCapabilityName | — |
DeviceId | — |
FunctionType | — |
Event ID 7703 — %2: Cannot register package %1 becuase the handler for DeviceCapability %6 could not be loaded.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
DeviceCapabilityName | — |
DeviceCapabilityHandlerCLSID | — |
MissingParameter | — |
Event ID 7704 — %2: Cannot register package %1 because the handler for DeviceCapability %6 is missing a required registry parameter (%8) and cannot be used.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
DeviceCapabilityName | — |
DeviceCapabilityHandlerCLSID | — |
MissingParameter | — |
Event ID 7705 — %2: Cannot register package %1 because of a problem with Device element %7: %9.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
DeviceCapabilityName | — |
DeviceId | — |
FunctionType | — |
VetoReason | — |
Event ID 7706 — %2: Cannot register package %1 because of a problem with Function element %8: %9.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
DeviceCapabilityName | — |
DeviceId | — |
FunctionType | — |
VetoReason | — |
Event ID 7707 — %2: Cannot register package %1 because of an error with DeviceCapability[@Name="%6"]\.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
DeviceCapabilityName | — |
ElementName | — |
AttributeName | — |
AttributeValue | — |
Event ID 7708 — %2: Cannot register package %1 because of an error in %6 (attribute %7): %9.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
Element | — |
Attribute | — |
Value | — |
Problem | — |
Event ID 7709 — %2: Cannot register package %1 because element %6 is missing required attribute %7.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
FileName | — |
Line | — |
Column | — |
Element | — |
Attribute | — |
Event ID 7750 — warning %2: The following error occurred while performing Indexed DB cleanup when removing the package: %1 (%3).
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
ErrorText | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 7750
version: 0
level: 3
task: 0
opcode: 0
keywords: 4611686018460942336
time_created: '2023-10-25T22:54:58.729088+00:00'
event_record_id: 5121
correlation:
ActivityID: D5BBEBF4-0795-0003-721C-BCD59507DA01
execution:
process_id: 5348
thread_id: 7536
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDevEval
security:
user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
PackageName: AppxManifest.xml
ErrorCode: '0x80070005'
ErrorText: "Access is denied.\r\n"
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 7751 — warning %2: The following error occurred while getting deployment options during Indexed DB cleanup when removing the package: %1 (%3).
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
ErrorText | — |
Event ID 7800 — AppSync DEH invoke ({InvokeAction}) on package={PackageFamilyName}.
Message
Fields
| Name | Description |
|---|---|
InvokeAction | — |
PackageFamilyName | — |
Event ID 7801 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7802 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7803 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7804 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7805 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7806 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7807 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7808 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7809 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7810 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 7900 — SearchIndexer extension has failed to connect into Windows Search service.
Message
Fields
| Name | Description |
|---|---|
PackageFamilyName | — |
Event ID 7901 — SearchIndexer extension started initialization
Message
Event ID 7902 — SearchIndexer extension has finished initialization with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 7903 — SearchIndexer extension started removal
Message
Event ID 7904 — SearchIndexer extension has finished removal of %1.
Message
Fields
| Name | Description |
|---|---|
PackageFamilyName | — |
Event ID 7910 — UserDataAccess extension started removal
Message
Event ID 7911 — UserDataAccess extension has finished removal of %1 (returned with %2).
Message
Fields
| Name | Description |
|---|---|
PackageFamilyName | — |
ErrorCode | — |
Event ID 7920 — %1(%2,%3) %4: The %5 package cannot be registered because an unexpected error occured while processing the alarm extension.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 7921 — %1(%2,%3) %4: The %5 package cannot register an alarm extension because it does not have the required lock screen capability.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 7950 — Geolocation extension could not invoke the Location Framework Service to remove package {PackageName}.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 7951 — Geolocation extension could not invoke the Visual Studio simulator to remove package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 7970 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 7971 — %1(%2,%3): error %4: Cannot register the %5 package because the extension is missing an EntryPoint or StartPage attribute.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7972 — %1(%2,%3): error %4: Cannot register the %5 package because the ServerName attribute cannot be specified for a preinstall task.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7973 — %1(%2,%3): error %4: Cannot register the %5 package because the Executable attribute cannot be specified for a preinstall task.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7980 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 7981 — %1(%2,%3): error %4: Cannot register the %5 package because the extension is missing an EntryPoint or StartPage attribute.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7982 — %1(%2,%3): error %4: Cannot register the %5 package because the ServerName attribute cannot be specified for an update task.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 7983 — %1(%2,%3): error %4: Cannot register the %5 package because the Executable attribute cannot be specified for an update task.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 8000 — AppXSvc service initialization failed.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 8001 — Updating service status to %1 failed with %2.
Message
Fields
| Name | Description |
|---|---|
ServiceStatus | — |
ErrorCode | — |
Event ID 8100 — Starting validation and setting the Trust Label on package %1 with flags %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Flags | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 8100
version: 0
level: 5
task: 49
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:22.056665+00:00'
event_record_id: 6933
correlation: {}
execution:
process_id: 1532
thread_id: 1016
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe
Flags: '0x112'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 8101 — Finished validation and setting the Trust Label on package %1 with flags %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Flags | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 8101
version: 0
level: 5
task: 49
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:22.163681+00:00'
event_record_id: 6936
correlation: {}
execution:
process_id: 1532
thread_id: 1016
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe
Flags: '0x112'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 8102 — Modified file %2 found in package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ModifiedFile | — |
Event ID 8103 — File %2 does not belong to package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ModifiedFile | — |
Event ID 8104 — Failed to set the Trust Label on package %1 with flags %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Flags | — |
ErrorCode | — |
Event ID 8105 — %2 file(s) have been validated from block map for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
NumberOfFiles | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 8105
version: 0
level: 5
task: 49
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:22.163509+00:00'
event_record_id: 6935
correlation: {}
execution:
process_id: 1532
thread_id: 1016
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe
NumberOfFiles: 11
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 8106 — Package %1 has Trust Label already.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Flags | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 8106
version: 0
level: 5
task: 49
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:23:18.613851+00:00'
event_record_id: 6808
correlation:
ActivityID: 626F7C94-1079-0000-B9AE-6F627910DA01
execution:
process_id: 1532
thread_id: 1660
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: MicrosoftWindows.Client.WebExperience_423.23500.0.0_x64__cw5n1h2txyewy
Flags: '0x9'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 8107 — Illegal non-AppStore or non-AppInstaller package integrity validation attempted for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Flags | — |
Event ID 8108 — Modified file %2 found in package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ModifiedFile | — |
Event ID 8200 — Successfully added volume %2 with name "%3", mountPoint "%4", and media ID "%5".
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
VolumeKey | — |
VolumeName | — |
VolumeMountPoint | — |
VolumeMediaID | — |
Event ID 8201 — Successfully set volume %2 with name "%3", mountPoint "%4", and media ID "%5" offline.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
VolumeKey | — |
VolumeName | — |
VolumeMountPoint | — |
VolumeMediaID | — |
Event ID 8202 — Successfully set volume %2 with name "%3", mountPoint "%4", and media ID "%5" online.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
VolumeKey | — |
VolumeName | — |
VolumeMountPoint | — |
VolumeMediaID | — |
Event ID 8203 — Successfully removed volume %2 with name "%3", mountPoint "%4", and media ID "%5".
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
VolumeKey | — |
VolumeName | — |
VolumeMountPoint | — |
VolumeMediaID | — |
Event ID 8204 — Successfully updated volume {VolumeKey} with name '{VolumeName}' mountPoint '{VolumeMountPoint}' and flags {Flags}.
Message
Fields
| Name | Description |
|---|---|
VolumeKey | — |
VolumeName | — |
VolumeMountPoint | — |
Flags | — |
Event ID 8205 — Error %1: Found a corrupt volume %2 with name "%3", mountPoint "%4", and media ID "%5".
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
VolumeKey | — |
VolumeName | — |
VolumeMountPoint | — |
VolumeMediaID | — |
Event ID 8206 — The path ".
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
VolumeKey | — |
VolumeName | — |
VolumeMountPoint | — |
VolumeMediaID | — |
Event ID 8220 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8221 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8222 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8223 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8224 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8225 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8226 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8227 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8228 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8229 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8230 — %1(%2, %3): error %4: Cannot register the %5 package because the following error was encountered while registering WebAccountProvider extension: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 8250 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 8251 — %1(%2,%3): error %4: Cannot register the %5 package because the extension is missing an EntryPoint or StartPage attribute.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 8252 — {FileName}({LineNumber};{ColumnNumber}): error {ErrorCode}: Cannot register the {PackageName} package because the ServerName attribute cannot be sp...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 8253 — {FileName}({LineNumber};{ColumnNumber}): error {ErrorCode}: Cannot register the {PackageName} package because the Executable attribute cannot be sp...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 8300 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 8351 — error %2: AoW App Evaluate Install failed for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 8352 — error %2: AoW App Evaluate Update failed for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 8353 — error %2: AoW App Commit failed for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 8354 — error %2: AoW App Revert failed with operation %1.
Message
Fields
| Name | Description |
|---|---|
CurrentOperation | — |
ErrorCode | — |
Event ID 8355 — error %2: AoW App Uninstall failed for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 8356 — error %2: AoW App failed to find the element PayloadName in the Manifest for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 8357 — error %2: AoW App failed to find the element PayloadVersion in the Manifest for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorCode | — |
Event ID 8400 — error %3: Cannot remove the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 8451 — error %3: Cannot remove the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 8460 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8461 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8462 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8463 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8464 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8465 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8466 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8467 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8468 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8469 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8481 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8482 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8483 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8484 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8485 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8486 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8487 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8488 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8489 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8490 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8501 — Compiling mof file %1 has the status information: phase error %2, number of object that is at fault %3, first line number of the object %4, last li...
Message
Fields
| Name | Description |
|---|---|
MofFile | — |
PhaseError | — |
ObjectNum | — |
FirstLine | — |
LastLine | — |
Event ID 8502 — Compiling mof file %1 has the status information: phase error %2, number of object that is at fault %3, first line number of the object %4, last li...
Message
Fields
| Name | Description |
|---|---|
MofFile | — |
PhaseError | — |
ObjectNum | — |
FirstLine | — |
LastLine | — |
Event ID 8503 — The WMI provider is not supported because its HostingModel is %1.
Message
Fields
| Name | Description |
|---|---|
HostingModel | — |
Event ID 8521 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8522 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8523 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8524 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8525 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8526 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8527 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8528 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8529 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8530 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8541 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8542 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8543 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8544 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8545 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8546 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8547 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8548 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8549 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8550 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8561 — Notify PackageStatus change for %1 with error %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Error | — |
Event ID 8562 — Verify for %1 with error %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Error | — |
Event ID 8563 — RegisterNotification for AppId[.
Message
Fields
| Name | Description |
|---|---|
AppId | — |
AppExtensionName | — |
Error | — |
Event ID 8564 — UnregisterNotification for AppId[.
Message
Fields
| Name | Description |
|---|---|
AppId | — |
AppExtensionName | — |
Error | — |
Event ID 8565 — GetNotificationPayload for AppId[.
Message
Fields
| Name | Description |
|---|---|
AppId | — |
AppExtensionName | — |
Error | — |
Event ID 8571 — Notify PackageStatus change for %1 with error %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Error | — |
Event ID 8572 — Verify for %1 with error %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Error | — |
Event ID 8573 — RegisterNotification for PackageFullName[.
Message
Fields
| Name | Description |
|---|---|
AppId | — |
PackageExtensionName | — |
Error | — |
Event ID 8574 — UnregisterNotification for PackageFullName[.
Message
Fields
| Name | Description |
|---|---|
AppId | — |
PackageExtensionName | — |
Error | — |
Event ID 8575 — GetNotificationPayload for PackageFullName[.
Message
Fields
| Name | Description |
|---|---|
AppId | — |
PackageExtensionName | — |
Error | — |
Event ID 8661 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8662 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8663 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8664 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8665 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8666 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8667 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8668 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8669 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8670 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8681 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8682 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8683 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8684 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8685 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8686 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8687 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8688 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8689 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8690 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8701 — Windows cannot install the package because the current user is not a member of Administrators group and creation of server extension failed.
Message
Event ID 8721 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 8722 — {FileName}({LineNumber};{ColumnNumber}): error {ErrorCode}: Cannot register the {PackageName} package because the extension is missing an EntryPoin...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 8723 — {FileName}({LineNumber};{ColumnNumber}): error {ErrorCode}: Cannot register the {PackageName} package because the ServerName attribute cannot be sp...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 8724 — {FileName}({LineNumber};{ColumnNumber}): error {ErrorCode}: Cannot register the {PackageName} package because the Executable attribute cannot be sp...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
LineNumber | — |
ColumnNumber | — |
ErrorCode | — |
PackageName | — |
Event ID 8751 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8752 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8753 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8754 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8755 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8756 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8757 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8758 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8759 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8760 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 8761 — AppExecutionAlias directory missing, error code is %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 9001 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9002 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9003 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9004 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9005 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9006 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9007 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9008 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9009 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9010 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9011 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9012 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9013 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9014 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9015 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9016 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9017 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9018 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9019 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9020 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
PathName | — |
Event ID 9021 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9022 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9023 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9024 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9025 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9026 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9027 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9028 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9029 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9030 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9031 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9032 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9033 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9034 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9035 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9036 — Package COM is not supported on this platform.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9037 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9038 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9039 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9051 — IIS Configuration Committed at {IISModuleName}.
Message
Fields
| Name | Description |
|---|---|
IISModuleName | — |
Event ID 9071 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9072 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9073 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9074 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9075 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9076 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9077 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9078 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9079 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9080 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9101 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9102 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9103 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9104 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9105 — {FileName}({Line};{Column}): error {ErrorCode}: Cannot register package {PackageName} .
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9121 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9122 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9123 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9124 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9125 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9126 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9127 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9128 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9129 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9130 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9131 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 9200 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9201 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9202 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9203 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9204 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9205 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9206 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9207 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9208 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9209 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9220 — Deleting the shared hardlink for the eventlog dll for package %2 at location %3 during %4 operation, error is %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
String3 | — |
Event ID 9221 — Extension 'windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9222 — Extension 'windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9300 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9301 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9302 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9303 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9304 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9305 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9306 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9307 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9308 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9309 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9400 — Failed to set Desktop AppX metadata for the package.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
PackageName | — |
Event ID 9401 —
Event ID 9402 —
Event ID 9403 — Failed to set Desktop AppX metadata for the path.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
ForMove | — |
Event ID 9404 —
Event ID 9405 —
Event ID 9406 — Failed to create output location for Desktop AppX registry files.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
Event ID 9407 — Failed to delete the Desktop AppX registry file.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
Event ID 9408 — Desktop AppX registry file was unexpectedly a directory.
Message
Fields
| Name | Description |
|---|---|
Path | — |
Event ID 9409 — Failed to delete the Desktop AppX registry directory.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Path | — |
Event ID 9410 — Failed to process the Desktop AppX registry file.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
SourcePath | — |
DestinationPath | — |
Flags | — |
Event ID 9500 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9501 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9502 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9503 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9504 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9505 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9506 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9507 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9508 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9509 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9510 — Couldn't install interop asssembly for %1 package because the assembly already exists: %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullname | — |
Path | — |
Event ID 9511 — Version downgrade happened for interop asssembly for %1 package, from version %2 to version %3.
Message
Fields
| Name | Description |
|---|---|
PackageFullname | — |
PreDowngradeVersion | — |
PostDowngradeVersion | — |
Event ID 9512 — PIA copyfile for %1 package failed, %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullname | — |
errorString | — |
Event ID 9521 — CC file pattern %1, hresult %2, error %3, index %4.
Message
Fields
| Name | Description |
|---|---|
SearchString | — |
HresultCode | — |
ErrorCode | — |
Index | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 9521
version: 0
level: 3
task: 0
opcode: 0
keywords: 4611694814520410112
time_created: '2023-11-05T22:33:32.152464+00:00'
event_record_id: 8495
correlation:
ActivityID: E4DB489E-1037-0000-617A-DBE43710DA01
execution:
process_id: 4660
thread_id: 5424
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
SearchString: C:\Program Files\WindowsApps\MicrosoftCorporationII.QuickAssist_2.0.5.0_x64__8wekyb3d8bbwe\*.sccd
HresultCode: '0x80004005'
ErrorCode: '0x2'
Index: 0
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 9541 — error %4: Package %1 declares capability %3 but its HostRuntimeDependency %2 does not.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
HostRuntimePackageFullName | — |
Capability | — |
ErrorCode | — |
Event ID 9542 — error %4: Package %1 declares custom capability %3 but its HostRuntimeDependency %2 does not.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
HostRuntimePackageFullName | — |
Capability | — |
ErrorCode | — |
Event ID 9543 — error %4: Package %1 declares device capability %3 but its HostRuntimeDependency %2 does not.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
HostRuntimePackageFullName | — |
Capability | — |
ErrorCode | — |
Event ID 9544 — The Capability DB will not be provisioned during MachineRegister.
Message
Event ID 9545 — Package is an Unsigned Package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9546 — The Capability DB was not previously provisioned during MachineRegister for Package full name.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9547 — error %3: Package %1 being registered declares HostRuntimeDependency %2, which does not have any capabilities or is not registered.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
HostRuntimePackageFullName | — |
ErrorCode | — |
Event ID 9548 — Authorization of capabilities for %1 failed with error code %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
Event ID 9600 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9601 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9602 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9603 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9604 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9605 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9606 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9607 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9608 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9609 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9621 — %1(%2,%3): error %4: Cannot register the %5 package.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9622 — %1: PackagedServiceDEH EvaluateRequest completed successfully.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 9623 — %1: PackagedServiceDEH CommitRequest completed successfully.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 9624 — %1: PackagedServiceDEH RevertRequest completed successfully.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 9625 — %1: PackagedServiceDEH RemoveRequest completed successfully.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 9626 — %1(%2,%3): PackagedServiceDEH successfully parsed manifest for package %5 install.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9627 — %1(%2,%3): PackagedServiceDEH successfully parsed manifest for package %5 removal.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 9628 — %1(%2,%3): PackagedServiceDEH failed to delete service %6 in package %5.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 9629 — %1: PackagedServiceDEH PostOsUpgradeEvaluateRequest completed successfully.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 9641 — %1: Deployment aborts due to active service %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9643 — %1: TerminateApplications successful.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 9643
version: 0
level: 5
task: 1
opcode: 0
keywords: 4611694814520410116
time_created: '2023-11-06T01:42:33.989681+00:00'
event_record_id: 9461
correlation:
ActivityID: E4DB489E-1037-0002-37CE-F0E43710DA01
execution:
process_id: 17796
thread_id: 22228
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
ErrorCode: '0x0'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 9644 — %1: AllowUninstall successful for package %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 9644
version: 0
level: 5
task: 1
opcode: 0
keywords: 4611694814520410116
time_created: '2023-10-25T22:55:10.381651+00:00'
event_record_id: 5407
correlation:
ActivityID: D5BBEBF4-0795-0001-6F34-BCD59507DA01
execution:
process_id: 5348
thread_id: 7532
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDevEval
security:
user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
ErrorCode: '0x0'
String: Microsoft.UI.Xaml.2.7_7.2208.15002.0_x64__8wekyb3d8bbwe
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 9645 — %1: GetActiveAumidsInPackage successful for package %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 9645
version: 0
level: 5
task: 1
opcode: 0
keywords: 4611694814520410116
time_created: '2023-11-05T22:29:19.763500+00:00'
event_record_id: 7647
correlation:
ActivityID: 59A0D65F-1037-0002-2BF3-A0593710DA01
execution:
process_id: 5296
thread_id: 5800
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
ErrorCode: '0x0'
String: Microsoft.WindowsStore_22309.1401.2.0_x64__8wekyb3d8bbwe
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 9646 — %1: TerminateServicesInPackage successful for package %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9647 — %1: TerminateSingleService for uninstall successful for service %3 in package %2, terminateService: %4.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Bool1 | — |
Event ID 9648 — %1: TerminateSingleService for update successful for service %3 in package %2, terminateService: %4.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Bool1 | — |
Event ID 9649 — %1: Cannot terminate service %3 in package %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 9650 — %1: Succesfully terminated service %3 in package %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 9651 — %1: Service %3 in package %2 has an error level that is marked either critical or severe.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 9652 — %1: Force terminated service %3 process in package %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 9653 — OpenService for service %2 failed with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9660 —
Fields
| Name | Description |
|---|---|
PackageFullName | — |
BiStateTransition | — |
ErrorCode | — |
Event ID 9660 — error %3: Unable to notify BrokerInfrastructure service for package %1 and state change %2.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
BiStateTransition | — |
ErrorCode | — |
Event ID 9681 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9682 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9683 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9684 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9700 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9701 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9702 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9703 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9704 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9705 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9706 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9707 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9708 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9709 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9720 — The shortcut variable '.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9721 — Shortcuts require CompatMode to be 'classic'.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9722 — Shortcut extension Scope must match the shortcut destination's KNOWNFOLDER scope.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9800 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9801 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9802 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9803 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9804 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9805 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9806 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9807 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9808 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9809 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9820 — The ApplicationRegistration variable '.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 9900 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9901 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9902 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9903 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9904 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9905 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9906 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9907 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9908 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9909 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 9920 — The registry key path must be compatible with the 'windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 10000 — About to service package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 10000
version: 0
level: 5
task: 4
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:22:35.495890+00:00'
event_record_id: 5860
correlation:
ActivityID: 626F7C94-1079-0003-2383-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: MicrosoftWindows.UndockedDevKit_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
ErrorCode: '0x0'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 10001 — Finished servicing package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 10001
version: 0
level: 5
task: 4
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:22:35.566901+00:00'
event_record_id: 5862
correlation:
ActivityID: 626F7C94-1079-0003-2383-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
PackageFullName: MicrosoftWindows.UndockedDevKit_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
ErrorCode: '0x0'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 10002 — Creating Resiliency File %3 for %1 Operation on Package %2.
Message
Fields
| Name | Description |
|---|---|
DeploymentOperation | — |
MainPackageMoniker | — |
ResiliencyFilePath | — |
Example Event
system:
provider: Microsoft-Windows-AppXDeployment-Server
guid: 3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43
event_source_name: ''
event_id: 10002
version: 0
level: 5
task: 3
opcode: 0
keywords: 4611686018427387905
time_created: '2023-11-06T06:22:35.444904+00:00'
event_record_id: 5856
correlation:
ActivityID: 626F7C94-1079-0003-2383-6F627910DA01
execution:
process_id: 1532
thread_id: 1636
channel: Microsoft-Windows-AppXDeploymentServer/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
DeploymentOperation: 6
MainPackageMoniker: MicrosoftWindows.UndockedDevKit_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
ResiliencyFilePath: C:\ProgramData\Microsoft\Windows\AppRepository\3ef662d8-1950-4cce-b7f7-458d48cab7cd_S-1-5-18_7.rslc
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 10003 — Deleting Resiliency File %1 finished with code %2.
Message
Fields
| Name | Description |
|---|---|
ResiliencyFilePath | — |
ErrorCode | — |
Event ID 10004 — Publishing deployment request status to TDL for package %1 : operation %2 state %3 percentage %4 errorcode %5 impersonating %6.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
DeploymentOperation | — |
State | — |
Percentage | — |
ErrorCode | — |
IsImpersonating | — |
Event ID 10005 — Published deployment request status to TDL for package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
Event ID 10006 — Failed to read the sideload limit from Software Licensing policy with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
UInt32Value | — |
Event ID 10007 — Finished servicing singleton package %1.
Message
Fields
| Name | Description |
|---|---|
PackageFullName | — |
ErrorCode | — |
Event ID 10050 — {FileName}({Line};{Column}) {ErrorCode}: The {PackageName} package cannot be registered because an unexpected error occured while processing the Lo...
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 11000 — Failed to install loopback access rule.
Message
Fields
| Name | Description |
|---|---|
PackageSID | — |
PackageFullName | — |
Capabilities | — |
ErrorCode | — |
Event ID 11001 — Failed to uninstall loopback access rule.
Message
Fields
| Name | Description |
|---|---|
PackageSID | — |
PackageFullName | — |
Capabilities | — |
ErrorCode | — |
Event ID 11100 — %1(%2,%3) %4: The %5 package cannot be registered because an unexpected error occured while processing the Local Experience Pack extension.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 11200 — PreInstalledVolumeServicing ApplySuccess started
Message
Event ID 11201 — PreInstalledVolumeServicing ApplySuccess finished
Message
Event ID 11202 — PreInstalledVolumeServicing ResetCleanup started
Message
Event ID 11203 — PreInstalledVolumeServicing ResetCleanup finished
Message
Event ID 11204 — PreInstalledVolumeServicing did not find an upgrade to service
Message
Event ID 11205 — PreInstalledVolumeServicing failed to get the PreInstalled AllUserStore with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 11206 — PreInstalledVolumeServicing failed to Activate required Instances with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 11207 — PreInstalledVolumeServicing failed to get the DefaultAccount Token with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 11208 — PreInstalledVolumeServicing failed to Migrate StateRepository with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 11209 — PreInstalledVolumeServicing failed to Remove apps with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 11210 — PreInstalledVolumeServicing failed to Prepare new apps with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 11211 — PreInstalledVolumeServicing failed to Delete the Upgrade Key with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 11212 — PreInstalledVolumeServicing failed to Remove package %2 with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 11213 — PreInstalledVolumeServicing failed to Upgrade package %2 with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 11214 — PreInstalledVolumeServicing failed to get the Applicable Version Upgrade key with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 11215 — PreInstalledVolumeServicing failed to Fix the Integrity of the AllUserStore with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 11900 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11901 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11902 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11903 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11904 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11905 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11906 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11907 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11908 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11909 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 11920 — Extension 'windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 12000 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12001 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12002 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12003 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12004 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12005 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12006 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12007 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12008 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12009 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12020 — Extension 'windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 12030 — Extension 'windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 12100 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12101 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12102 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12103 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12104 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12105 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12106 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12107 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12108 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12109 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12120 — Extension 'windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 12200 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12201 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12202 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12203 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12204 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12205 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12206 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12207 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12208 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12209 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12220 — Extension 'windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 12230 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12231 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12232 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12233 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12234 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12235 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12236 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12237 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12238 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12239 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12240 — Extension 'windows.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Event ID 12241 — A Provider element was found to have a duplicate Id attribute %3.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String | — |
Guid | — |
Event ID 12242 — A Provider element was found to have a duplicate Name attribute %3.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 12243 — A Channel element was found to have a duplicate Name attribute %3.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 12244 — A Channel element with the Name attribute %3 referenced by an ImportChannel element in Provider with Id %4 was not found.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Guid | — |
Event ID 12245 — A circular dependency between Provider elements was detected.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Guid | — |
Event ID 12246 — An event tracing provider from package %1 was not registered due to its guid conflicting with another package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ProviderGuid | — |
ProviderName | — |
OtherPackageName | — |
Event ID 12247 — An event tracing provider from package %1 was not registered due to its name conflicting with another package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ProviderGuid | — |
ProviderName | — |
OtherPackageName | — |
Event ID 12248 — An event tracing provider from package %1 was not registered due to a channel name conflicting with another package.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ProviderGuid | — |
ProviderName | — |
DuplicateChannelName | — |
OtherPackageName | — |
Event ID 12249 — An event tracing provider from package %1 was not registered due to its dependency provider not being registered.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ProviderGuid | — |
ProviderName | — |
DependencyProviderGuid | — |
Event ID 12250 — An event tracing provider registration from package %1 was overwritten when another package with a conflicting guid was installed.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ProviderGuid | — |
ProviderName | — |
OtherPackageName | — |
Event ID 12251 — An event tracing provider registration from package %1 was overwritten when another package with a conflicting name was installed.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ProviderGuid | — |
ProviderName | — |
OtherPackageName | — |
Event ID 12252 — An event tracing provider registration from package %1 was overwritten when another package with a conflicting channel name was installed.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ProviderGuid | — |
ProviderName | — |
DuplicateChannelName | — |
OtherPackageName | — |
Event ID 12253 — An event tracing provider registration from package %1 was overwritten due to its dependency provider being overwritten when another package with a...
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ProviderGuid | — |
ProviderName | — |
DependencyProviderGuid | — |
Event ID 12254 — Registering the event tracing provider with Id %4 and Name %3 from package %2 failed with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Guid | — |
Event ID 12255 — Unregistering the event tracing provider with Id %4 and Name %3 from package %2 failed with error %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Guid | — |
Event ID 12270 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12271 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12272 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12273 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12274 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12275 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12276 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12277 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12278 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12279 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12280 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 12290 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12291 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12292 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12293 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12294 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12295 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12296 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12297 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12298 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12299 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12310 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12311 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12312 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12313 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12314 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12315 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12316 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12317 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12318 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12319 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12330 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12331 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12332 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12333 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12334 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12335 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12336 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12337 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12338 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12339 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12340 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |
Event ID 12350 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12351 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12352 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12353 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12354 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12355 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12356 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12357 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12358 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12359 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12370 — Deleting the shared hardlink for the eventlog dll for package %2 at location %3 during %4 operation, error is %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
String3 | — |
Event ID 12390 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12391 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12392 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12393 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12394 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12395 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12396 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12397 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12398 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12399 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12500 — Untrusted reparse point redirection skipped for file %1 in package %2.
Message
Fields
| Name | Description |
|---|---|
String1 | — |
String2 | — |
Event ID 12501 — Untrusted reparse point delete successful for file %1 in package %2.
Message
Fields
| Name | Description |
|---|---|
String1 | — |
String2 | — |
Event ID 12502 — Untrusted reparse point delete failed, error:%1 for file %2 in package %3.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 12510 — %1(%2,%3): ContextMenuShellExHandlerDEH parsed IncomingPackage: %5.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 12511 — %1(%2,%3): ContextMenuShellExHandlerDEH parsed OutgoingPackage: %5.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
Event ID 12512 — %1(%2,%3): ContextMenuShellExHandlerDEH Cannot register package %5 due to the following error: %6.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Line | — |
Column | — |
ErrorCode | — |
PackageName | — |
ErrorText | — |
Event ID 12513 — %1: ContextMenuShellExHandlerDEH EvaluateRequest completed.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 12514 — %1: ContextMenuShellExHandlerDEH CommitRequest completed.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 12515 — %1: ContextMenuShellExHandlerDEH RevertRequest completed.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 12516 — %1: ContextMenuShellExHandlerDEH RemoveRequest completed.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 12520 — %1: Undocked DEH Category %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 12521 — %1: Undocked DEH Category %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 12522 — %1: Undocked DEH Category %2.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
String1 | — |
String2 | — |
Event ID 12531 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12532 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12533 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12534 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12535 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12536 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12537 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12538 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12539 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12540 —
Fields
| Name | Description |
|---|---|
PackageName | — |
Event ID 12541 — error %3: Cannot register the %1 package due to the following error: %2.
Message
Fields
| Name | Description |
|---|---|
PackageName | — |
ErrorText | — |
ErrorCode | — |