detection.wiki

Microsoft-Windows-AppXDeployment-Server-UndockedDeh

16 events across 1 channel

Event IDTitleChannel
9000Installing EventLog manifest for package: 'PackageFullName' (See 'Details' for …Operational
9001Uninstalling EventLog manifest for package: 'PackageFullName' (See 'Details' for …Operational
9002Installed EventLog manifest for package: 'PackageFullName' (See 'Details' for …Operational
9003Uninstalled EventLog manifest for package: 'PackageFullName' (See 'Details' for …Operational
9004Setting active EventLog manifest for package: 'PackageFullName' (See 'Details' …Operational
9005Unsetting active EventLog manifest for package: 'PackageFullName' (See 'Details' …Operational
10001Loading registration table for Undocked DEH dll: DllName, Path: DllPath, Phase: …Operational
10002Evaluating request for DEH: DEH 'DehName' in Phase 'DehPhase'.Operational
10003StringAddEntryEvent: StringAddEntryEvent.Operational
10004Failed performing DEH request: Action 'DehAction' in DEH 'DehName' in Phase …Operational
10005Failed performing operation on entry: Operation 'Operation' on Entry 'EntryName' …Operational
10006Encountered package pair in DEH package evaluation: DEH 'DehName' in Phase …Operational
10007Encountered package in DEH package evaluation: Direction 'Direction', DEH …Operational
10008Failure working on items: Item count 'ItemCounter', Current item name …Operational
10009Failure working on item: Item 'ItemName', Step counter 'StepCounter'.Operational
10010Failure at frame: File 'File', Line 'Line' (See 'Details' for extended …Operational

Event ID 9000 — Installing EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Level
Informational
Task
AppXDeployment.Task.Server.OSIM

Description

Installing EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Installing EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

NameDescription
PackageFullName UnicodeString—
UndockedDehDllParent UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9000,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-12T20:24:32.772993+00:00",
    "event_record_id": 20,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-5477-AB432A9ADC01"
    },
    "execution": {
      "process_id": 14100,
      "thread_id": 14308
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.770.947.0_x86__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 9001 — Uninstalling EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Level
Informational
Task
AppXDeployment.Task.Server.OSIM

Description

Uninstalling EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Uninstalling EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

NameDescription
PackageFullName UnicodeString—
UndockedDehDllParent UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9001,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-14T21:02:04.441681+00:00",
    "event_record_id": 29,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-BE97-B0432A9ADC01"
    },
    "execution": {
      "process_id": 10288,
      "thread_id": 8476
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.731.1532.0_x86__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 9002 — Installed EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Level
Informational
Task
AppXDeployment.Task.Server.OSIM

Description

Installed EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Installed EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

NameDescription
PackageFullName UnicodeString—
UndockedDehDllParent UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9002,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-12T20:24:33.569657+00:00",
    "event_record_id": 22,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-5477-AB432A9ADC01"
    },
    "execution": {
      "process_id": 14100,
      "thread_id": 14308
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.770.947.0_x86__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 9003 — Uninstalled EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Level
Informational
Task
AppXDeployment.Task.Server.OSIM

Description

Uninstalled EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Uninstalled EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

NameDescription
PackageFullName UnicodeString—
UndockedDehDllParent UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9003,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-14T21:02:04.442072+00:00",
    "event_record_id": 30,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-BE97-B0432A9ADC01"
    },
    "execution": {
      "process_id": 10288,
      "thread_id": 8476
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.731.1532.0_x86__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 9004 — Setting active EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Task
AppXDeployment.Task.Server.OSIM

Description

Setting active EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Setting active EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

NameDescription
PackageFullName UnicodeString—
UndockedDehDllParent UnicodeString—

Event ID 9005 — Unsetting active EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Level
Informational
Task
AppXDeployment.Task.Server.OSIM

Description

Unsetting active EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Unsetting active EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

NameDescription
PackageFullName UnicodeString—
UndockedDehDllParent UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9005,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-12T20:24:32.774106+00:00",
    "event_record_id": 21,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-5477-AB432A9ADC01"
    },
    "execution": {
      "process_id": 14100,
      "thread_id": 14308
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.770.947.0_x64__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 10001 — Loading registration table for Undocked DEH dll: DllName, Path: DllPath, Phase: DehPhase.

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Task
AppXDeployment.Task.Server.OSIM

Description

Loading registration table for Undocked DEH dll: DllName, Path: DllPath, Phase: DehPhase.

Message #

Loading registration table for Undocked DEH dll: %1, Path: %2, Phase: %3

Fields #

NameDescription
DllName UnicodeString—
DllPath UnicodeString—
DehPhase HexInt32—

Event ID 10002 — Evaluating request for DEH: DEH 'DehName' in Phase 'DehPhase'.

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Level
Verbose
Task
AppXDeployment.Task.Server.OSIM

Description

Evaluating request for DEH: DEH 'DehName' in Phase 'DehPhase'.

Message #

Evaluating request for DEH: DEH '%1' in Phase '%2'

Fields #

NameDescription
DehName UnicodeString—
DehPhase HexInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 10002,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-14T21:02:04.440924+00:00",
    "event_record_id": 28,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-BE97-B0432A9ADC01"
    },
    "execution": {
      "process_id": 10288,
      "thread_id": 8476
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DehName": "WindowsAppSdk.UndockedDeh.InstallMyself.InstallMyselfDeh",
    "DehPhase": "0x1"
  },
  "message": ""
}

Event ID 10003 — StringAddEntryEvent: StringAddEntryEvent.

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Task
AppXDeployment.Task.Server.OSIM

Description

StringAddEntryEvent: StringAddEntryEvent.

Message #

StringAddEntryEvent: %1

Fields #

NameDescription
StringAddEntryEvent—
ExceptionWhatString AnsiString—

Event ID 10004 — Failed performing DEH request: Action 'DehAction' in DEH 'DehName' in Phase 'DehPhase' in State 'DehState' (See 'Details' for extended information).

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Task
AppXDeployment.Task.Server.OSIM

Description

Failed performing DEH request: Action 'DehAction' in DEH 'DehName' in Phase 'DehPhase' in State 'DehState' (See 'Details' for extended information).

Message #

Failed performing DEH request: Action '%1' in DEH '%2' in Phase '%3' in State '%4' (See 'Details' for extended information)

Fields #

NameDescription
DehAction UnicodeString—
DehName UnicodeString—
DehPhase HexInt32—
DehState UInt32—
ExceptionWhatString AnsiString—

Event ID 10005 — Failed performing operation on entry: Operation 'Operation' on Entry 'EntryName' (See 'Details' for extended information).

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Task
AppXDeployment.Task.Server.OSIM

Description

Failed performing operation on entry: Operation 'Operation' on Entry 'EntryName' (See 'Details' for extended information).

Message #

Failed performing operation on entry: Operation '%1' on Entry '%2' (See 'Details' for extended information)

Fields #

NameDescription
Operation UnicodeString—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
EntryName UnicodeString—
SerializedEntry UnicodeString—
StepCounter UInt32—
ExceptionWhatString AnsiString—

Event ID 10006 — Encountered package pair in DEH package evaluation: DEH 'DehName' in Phase 'DehPhase' State 'DehState' on Incoming Package 'IncomingPackage' and Outgoing Package 'OutgoingPackage'.

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Task
AppXDeployment.Task.Server.OSIM

Description

Encountered package pair in DEH package evaluation: DEH 'DehName' in Phase 'DehPhase' State 'DehState' on Incoming Package 'IncomingPackage' and Outgoing Package 'OutgoingPackage' (See 'Details' for extended information).

Message #

Encountered package pair in DEH package evaluation: DEH '%1' in Phase '%2' State '%3' on Incoming Package '%4' and Outgoing Package '%5' (See 'Details' for extended information)

Fields #

NameDescription
DehName UnicodeString—
DehPhase HexInt32—
DehState UInt32—
IncomingPackage UnicodeString—
OutgoingPackage UnicodeString—

Event ID 10007 — Encountered package in DEH package evaluation: Direction 'Direction', DEH 'DehName', Package 'PackageFullName', PostOsUpgrade 'PostOsUpgrade', Phase 'DehPhase', State 'DehState'.

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Level
Verbose
Task
AppXDeployment.Task.Server.OSIM

Description

Encountered package in DEH package evaluation: Direction 'Direction', DEH 'DehName', Package 'PackageFullName', PostOsUpgrade 'PostOsUpgrade', Phase 'DehPhase', State 'DehState' (See 'Details' for extended information).

Message #

Encountered package in DEH package evaluation: Direction '%1', DEH '%2', Package '%3', PostOsUpgrade '%4', Phase '%5', State '%6' (See 'Details' for extended information)

Fields #

NameDescription
Direction UnicodeString—
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
DehName UnicodeString—
PackageFullName UnicodeString—
PostOsUpgrade Boolean—
DehPhase HexInt32—
DehState UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 10007,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-14T21:02:04.440815+00:00",
    "event_record_id": 27,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-BE97-B0432A9ADC01"
    },
    "execution": {
      "process_id": 10288,
      "thread_id": 8476
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Direction": "Outgoing",
    "DehName": "WindowsAppSdk.UndockedDeh.InstallMyself.InstallMyselfDeh",
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.731.1532.0_x86__8wekyb3d8bbwe",
    "PostOsUpgrade": false,
    "DehPhase": "0x1",
    "DehState": 4
  },
  "message": ""
}

Event ID 10008 — Failure working on items: Item count 'ItemCounter', Current item name 'ItemName', Step counter 'StepCounter'.

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Task
AppXDeployment.Task.Server.OSIM

Description

Failure working on items: Item count 'ItemCounter', Current item name 'ItemName', Step counter 'StepCounter'.

Message #

Failure working on items: Item count '%1', Current item name '%2', Step counter '%3'

Fields #

NameDescription
ItemCounter UInt32—
ItemName UnicodeString—
StepCounter UInt32—

Event ID 10009 — Failure working on item: Item 'ItemName', Step counter 'StepCounter'.

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Task
AppXDeployment.Task.Server.OSIM

Description

Failure working on item: Item 'ItemName', Step counter 'StepCounter'.

Message #

Failure working on item: Item '%1', Step counter '%2'

Fields #

NameDescription
ItemName UnicodeString—
StepCounter UInt32—

Event ID 10010 — Failure at frame: File 'File', Line 'Line' (See 'Details' for extended information).

Provider
Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel
Operational
Task
AppXDeployment.Task.Server.OSIM

Description

Failure at frame: File 'File', Line 'Line' (See 'Details' for extended information).

Message #

Failure at frame: File '%1', Line '%2' (See 'Details' for extended information)

Fields #

NameDescription
File AnsiString—
Line UInt32—
ExceptionWhatString AnsiString—