detection.wiki

Microsoft-Windows-AppXDeployment-Server › Event 478

Event ID 478 — Deployment DeploymentOperation operation with target volume MountPoint on Package PackageFullName from: Path finished successfully.

Provider
Microsoft-Windows-AppXDeployment-Server
Channel
Operational
Level
Verbose
Task
AppXDeployment.Task.Server.Deployment

Description

Deployment DeploymentOperation operation with target volume MountPoint on Package PackageFullName from: Path finished successfully.

Message #

Deployment %1 operation with target volume %4 on Package %2 from: %3 finished successfully.

Fields #

NameDescription
DeploymentOperation UInt32—
PackageFullName UnicodeString—
Path UnicodeString2 from.
MountPoint UnicodeString—
TargetPlatform HexInt32—
SystemVolume Boolean—
StorageId UnicodeString—
IsCentennial Boolean—
PackageType HexInt32—
IsPackageEncrypted Boolean—
DeploymentOptions HexInt64—
IsStreamingPackage Boolean—
IsInRelatedSet Boolean—
IsPackageUsingBDC Boolean—
MainPackageFamilyName UnicodeString—
CallingProcess UnicodeString—
IsOptional Boolean—
PackageFlags HexInt32—
PackageFlags2 HexInt32—
HasWin32alacarte Boolean—
HasFullTrust Boolean—
ExternalLocation UnicodeString—
PackageSourceUri UnicodeString—
PackageDisplayName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server",
    "guid": "3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43",
    "event_source_name": "",
    "event_id": 478,
    "version": 0,
    "level": 5,
    "task": 3,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2023-11-06T06:23:19.442883+00:00",
    "event_record_id": 6813,
    "correlation": {
      "ActivityID": "626F7C94-1079-0000-B9AE-6F627910DA01"
    },
    "execution": {
      "process_id": 1532,
      "thread_id": 1660
    },
    "channel": "Microsoft-Windows-AppXDeploymentServer/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeploymentOperation": 12,
    "PackageFullName": "MicrosoftWindows.Client.WebExperience_423.23500.0.0_x64__cw5n1h2txyewy",
    "Path": " ",
    "MountPoint": "C:",
    "TargetPlatform": "0x3",
    "SystemVolume": true,
    "StorageId": "\\\\?\\Volume{7597d2a3-4404-4f99-b979-6233378a81bf}",
    "IsCentennial": true,
    "PackageType": "0x1",
    "IsPackageEncrypted": false,
    "DeploymentOptions": "0x10000020",
    "IsStreamingPackage": false,
    "IsInRelatedSet": false,
    "IsPackageUsingBDC": false,
    "MainPackageFamilyName": "NULL",
    "CallingProcess": "",
    "IsOptional": false,
    "PackageFlags": "0x88004c",
    "PackageFlags2": "0x800",
    "HasWin32alacarte": false,
    "HasFullTrust": true,
    "ExternalLocation": "",
    "PackageSourceUri": "",
    "PackageDisplayName": "Windows Web Experience Pack"
  },
  "message": ""
}

References #