detection.wiki

Microsoft-Windows-AppXDeployment-Server › Event 438

Event ID 438 — Framework PackageMoniker is no longer explicitly installed but remains implicitly installed because packages still depend on it.

Provider
Microsoft-Windows-AppXDeployment-Server
Channel
Operational
Level
Verbose
Task
AppXDeployment.Task.Server.Dependency

Description

Framework is no longer explicitly installed but remains implicitly installed because packages still depend on it. Windows will automatically remove the framework when no other packages depend on it.

Message #

Framework %1 is no longer explicitly installed but remains implicitly installed because packages still depend on it. Windows will automatically remove the framework when no other packages depend on it.

Fields #

NameDescription
PackageMoniker UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server",
    "guid": "3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43",
    "event_source_name": "",
    "event_id": 438,
    "version": 0,
    "level": 5,
    "task": 4,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2023-10-25T22:54:15.216190+00:00",
    "event_record_id": 4935,
    "correlation": {
      "ActivityID": "D5BBEBF4-0795-0001-E929-BCD59507DA01"
    },
    "execution": {
      "process_id": 5348,
      "thread_id": 7452
    },
    "channel": "Microsoft-Windows-AppXDeploymentServer/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "PackageMoniker": "Microsoft.UI.Xaml.2.7_7.2208.15002.0_x86__8wekyb3d8bbwe"
  },
  "message": ""
}

References #