detection.wiki

Microsoft-Windows-AppXDeployment

93 events across 2 channels

Event IDTitleChannel
301The calling process is {FileName}.Operational
302Failed to start system service: ServiceName with error: ErrorCode.Operational
303Failed to start system service: ServiceName with error: ErrorCode.Operational
304Starting recovery of package repository during a RecoveryType.Operational
305Finished recovery of package repository with result code ErrorCode.Operational
306Skipping recovery of package PackageFullName because it is already installed.Operational
307Recovery has completed for package PackageFullName with result code ErrorCode.Operational
308Starting staged package recovery.Operational
309Finished staged package recovery with result code ErrorCode.Operational
310Skipping recovery of package PackageFullName because of error ErrorCode.Operational
311Failed to bind to the APPXSVC RPC server with error: ErrorCode.Operational
312ErrorCode: Package runtime information FileName is corrupted …Operational
313ErrorCode: Package runtime information FileName is missing expected data …Operational
314ErrorCode: Package runtime information FileName contains conflicting data …Operational
315ErrorCode: Package runtime information FileName contains unexpected data …Operational
316ErrorCode: Package runtime information FileName failed to load …Operational
317Package runtime information FileName failed to load because exception …Operational
318ErrorCode: Package runtime information FileName is missing expected data …Operational
319ErrorCode: Application identity not accessible while loading package runtime …Operational
320Failed to queue removal of package PackageName for user UserSid with error: …Operational
321Failed to remove the package files of package PackageName with error: ErrorCode.Operational
322Failed to set the package status of package PackageName with error: ErrorCode.Operational
323Failed to remove {PackageName} for the user ({UserSid}) with error: {ErrorCode}.Operational
324Package runtime information FileName failed to refresh because the following …Operational
325PackageFamilyName is registered in good state, skip re-registering it.Operational
326Determining packages to be installed during logon for user: UserSid.Operational
327The following packages will be installed: InstallPackageList.Operational
328Unable to determine packages to be installed during logon with error: ErrorCode.Operational
329User Profile created for UserSid with path ProfilePath and type ProfileType.Operational
330User Profile deleted for UserSid with path ProfilePath and type ProfileType.Operational
331Outdated packages registered to user UserSid: OutdatedPackages.Operational
332Deployment operation deploymentOperation on mainParam with options …Operational
1001Diagnostic
1002Diagnostic
1003Diagnostic
1004Diagnostic
1005Diagnostic
1006Diagnostic
1007Diagnostic
1008Diagnostic
1009Diagnostic
1010Diagnostic
1011Diagnostic
1012Diagnostic
1013Diagnostic
1014Diagnostic
1015Diagnostic
1016Diagnostic
1017Diagnostic
1018Diagnostic
1019Diagnostic
1020Diagnostic
1021Diagnostic
1022Diagnostic
1023Diagnostic
1024Diagnostic
1025Diagnostic
1026Diagnostic
1027Diagnostic
1028Diagnostic
1029Diagnostic
1030Diagnostic
1031Diagnostic
1032Diagnostic
1033Diagnostic
1034Diagnostic
1035Diagnostic
1036Diagnostic
1037Diagnostic
1038Diagnostic
1039Diagnostic
1040Diagnostic
1041Diagnostic
1042Diagnostic
1043Diagnostic
1044Diagnostic
1045Diagnostic
1046Diagnostic
1047Diagnostic
1048Diagnostic
1049Diagnostic
1050Diagnostic
1051Diagnostic
1052Diagnostic
1053Diagnostic
1054Diagnostic
1055Diagnostic
1056Diagnostic
1057Diagnostic
1058Diagnostic
1059Diagnostic
1060Diagnostic
1061Diagnostic

Event ID 301 — The calling process is {FileName}.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational

Description

The calling process is {FileName}.

Message #

The calling process is {FileName}

Fields #

NameDescription
FileName—

Event ID 302 — Failed to start system service: ServiceName with error: ErrorCode.

#
Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Level
Error
Task
AppXDeployment.Task.Client.Deployment

Description

Failed to start system service: ServiceName with error: ErrorCode.

Message #

Failed to start system service: %1 with error: %2.

Fields #

NameDescription
ServiceName UnicodeStringFailed to start system service.
ErrorCode HexInt32with error.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment",
    "guid": "8127F6D4-59F9-4ABF-8952-3E3A02073D5F",
    "event_source_name": "",
    "event_id": 302,
    "version": 0,
    "level": 2,
    "task": 4,
    "opcode": 0,
    "keywords": 4611756387171631104,
    "time_created": "2022-04-07T16:45:08.860422+00:00",
    "event_record_id": 2,
    "correlation": {
      "ActivityID": "C1DC836A-4A9E-0000-538F-DCC19E4AD801"
    },
    "execution": {
      "process_id": 3864,
      "thread_id": 3868
    },
    "channel": "Microsoft-Windows-AppXDeployment/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ServiceName": "appxsvc",
    "ErrorCode": "0x8007045b"
  },
  "message": ""
}

References #

Event ID 303 — Failed to start system service: ServiceName with error: ErrorCode.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Failed to start system service: ServiceName with error: ErrorCode.

Message #

Failed to start system service: %1 with error: %2.

Fields #

NameDescription
ServiceName UnicodeString—
ErrorCode HexInt32—

Event ID 304 — Starting recovery of package repository during a RecoveryType.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Starting recovery of package repository during a RecoveryType.

Message #

Starting recovery of package repository during a %1.

Fields #

NameDescription
RecoveryType UInt32—

Event ID 305 — Finished recovery of package repository with result code ErrorCode.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Finished recovery of package repository with result code ErrorCode.

Message #

Finished recovery of package repository with result code %1.

Fields #

NameDescription
ErrorCode HexInt32—

Event ID 306 — Skipping recovery of package PackageFullName because it is already installed.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Skipping recovery of package PackageFullName because it is already installed.

Message #

Skipping recovery of package %1 because it is already installed.

Fields #

NameDescription
PackageFullName UnicodeString—

Event ID 307 — Recovery has completed for package PackageFullName with result code ErrorCode.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Recovery has completed for package PackageFullName with result code ErrorCode.

Message #

Recovery has completed for package %2 with result code %1.

Fields #

NameDescription
ErrorCode HexInt32—
PackageFullName UnicodeString—

Event ID 308 — Starting staged package recovery.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Starting staged package recovery.

Message #

Starting staged package recovery.

Event ID 309 — Finished staged package recovery with result code ErrorCode.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Finished staged package recovery with result code ErrorCode.

Message #

Finished staged package recovery with result code %1.

Fields #

NameDescription
ErrorCode HexInt32—

Event ID 310 — Skipping recovery of package PackageFullName because of error ErrorCode.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Skipping recovery of package PackageFullName because of error ErrorCode.

Message #

Skipping recovery of package %1 because of error %2.

Fields #

NameDescription
PackageFullName UnicodeString—
ErrorCode HexInt32—

Event ID 311 — Failed to bind to the APPXSVC RPC server with error: ErrorCode.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Failed to bind to the APPXSVC RPC server with error: ErrorCode.

Message #

Failed to bind to the APPXSVC RPC server with error: %1.

Fields #

NameDescription
ErrorCode HexInt32—

Event ID 312 — ErrorCode: Package runtime information FileName is corrupted (address=HeaderAddr, size=Size, offset=Offset, section=Section, processid=ProcessId).

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

ErrorCode: Package runtime information FileName is corrupted (address=HeaderAddr, size=Size, offset=Offset, section=Section, processid=ProcessId). Reinstall the package to fix this issue.

Message #

%2: Package runtime information %1 is corrupted (address=%5, size=%3, offset=%4, section=%6, processid=%7). Reinstall the package to fix this issue.

Fields #

NameDescription
FileName UnicodeString—
ErrorCode HexInt32—
Size UInt64—
Offset UInt32—
HeaderAddr Pointer—
Section UnicodeString—
ProcessId UInt32—

Event ID 313 — ErrorCode: Package runtime information FileName is missing expected data (address=HeaderAddr, size=Size, section=Section, processid=ProcessId).

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

ErrorCode: Package runtime information FileName is missing expected data (address=HeaderAddr, size=Size, section=Section, processid=ProcessId). Reinstall the package to fix this issue.

Message #

%2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6). Reinstall the package to fix this issue.

Fields #

NameDescription
FileName UnicodeString—
ErrorCode HexInt32—
Size UInt64—
HeaderAddr Pointer—
Section UnicodeString—
ProcessId UInt32—

Event ID 314 — ErrorCode: Package runtime information FileName contains conflicting data (address=HeaderAddr, size=Size, offset=Offset, section=Section, processid=ProcessId).

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

ErrorCode: Package runtime information FileName contains conflicting data (address=HeaderAddr, size=Size, offset=Offset, section=Section, processid=ProcessId). Reinstall the package to fix this issue.

Message #

%2: Package runtime information %1 contains conflicting data (address=%5, size=%3, offset=%4, section=%6, processid=%7). Reinstall the package to fix this issue.

Fields #

NameDescription
FileName UnicodeString—
ErrorCode HexInt32—
Size UInt64—
Offset UInt32—
HeaderAddr Pointer—
Section UnicodeString—
ProcessId UInt32—

Event ID 315 — ErrorCode: Package runtime information FileName contains unexpected data (address=HeaderAddr, size=Size, offset=Offset, section=Section, processid=ProcessId).

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

ErrorCode: Package runtime information FileName contains unexpected data (address=HeaderAddr, size=Size, offset=Offset, section=Section, processid=ProcessId). Reinstall the package to fix this issue.

Message #

%2: Package runtime information %1 contains unexpected data (address=%5, size=%3, offset=%4, section=%6, processid=%7). Reinstall the package to fix this issue.

Fields #

NameDescription
FileName UnicodeString—
ErrorCode HexInt32—
Size UInt64—
Offset UInt32—
HeaderAddr Pointer—
Section UnicodeString—
ProcessId UInt32—

Event ID 316 — ErrorCode: Package runtime information FileName failed to load (processid=ProcessId).

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

ErrorCode: Package runtime information FileName failed to load (processid=ProcessId).

Message #

%2: Package runtime information %1 failed to load (processid=%3).

Fields #

NameDescription
FileName UnicodeString—
ErrorCode HexInt32—
ProcessId UInt32—

Event ID 317 — Package runtime information FileName failed to load because exception ExceptionCode occurred.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

Package runtime information FileName failed to load because exception ExceptionCode occurred.

Message #

Package runtime information %1 failed to load because exception %2 occurred.

Fields #

NameDescription
FileName UnicodeString—
ExceptionCode Int32—

Event ID 318 — ErrorCode: Package runtime information FileName is missing expected data (address=HeaderAddr, size=Size, section=ApplicationUserModelId, processid=ProcessId).

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

ErrorCode: Package runtime information FileName is missing expected data (address=HeaderAddr, size=Size, section=ApplicationUserModelId, processid=ProcessId). Reinstall the package to fix this issue.

Message #

%2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6). Reinstall the package to fix this issue.

Fields #

NameDescription
FileName UnicodeString—
ErrorCode Int32—
Size UInt64—
HeaderAddr Pointer—
ApplicationUserModelId UnicodeString—
ProcessId UInt32—

Event ID 319 — ErrorCode: Application identity not accessible while loading package runtime information FileName (address=HeaderAddr, size=Size, processid=ProcessId).

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

ErrorCode: Application identity not accessible while loading package runtime information FileName (address=HeaderAddr, size=Size, processid=ProcessId).

Message #

%2: Application identity not accessible while loading package runtime information %1 (address=%4, size=%3, processid=%5).

Fields #

NameDescription
FileName UnicodeString—
ErrorCode Int32—
Size UInt64—
HeaderAddr Pointer—
ProcessId UInt32—

Event ID 320 — Failed to queue removal of package PackageName for user UserSid with error: ErrorCode.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Failed to queue removal of package PackageName for user UserSid with error: ErrorCode.

Message #

Failed to queue removal of package %1 for user %2 with error: %3.

Fields #

NameDescription
PackageName UnicodeString—
UserSid UnicodeString—
ErrorCode HexInt32—

Event ID 321 — Failed to remove the package files of package PackageName with error: ErrorCode.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Failed to remove the package files of package PackageName with error: ErrorCode.

Message #

Failed to remove the package files of package %1 with error: %2.

Fields #

NameDescription
PackageName UnicodeString—
ErrorCode HexInt32—

Event ID 322 — Failed to set the package status of package PackageName with error: ErrorCode.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Task
AppXDeployment.Task.Client.Deployment

Description

Failed to set the package status of package PackageName with error: ErrorCode.

Message #

Failed to set the package status of package %1 with error: %2.

Fields #

NameDescription
PackageName UnicodeString—
ErrorCode HexInt32—

Event ID 323 — Failed to remove {PackageName} for the user ({UserSid}) with error: {ErrorCode}.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational

Description

Failed to remove {PackageName} for the user ({UserSid}) with error: {ErrorCode}.

Message #

Failed to remove {PackageName} for the user ({UserSid}) with error: {ErrorCode}.

Fields #

NameDescription
PackageName—
UserSid—
ErrorCode—

Event ID 324 — Package runtime information FileName failed to refresh because the following error ErrorCode occurred in operation type Type.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

Package runtime information FileName failed to refresh because the following error ErrorCode occurred in operation type Type.

Message #

Package runtime information %1 failed to refresh because the following error %2 occurred in operation type %3.

Fields #

NameDescription
FileName UnicodeString—
ErrorCode Int32—
Type UnicodeString—
ProcessId UInt32—

Event ID 325 — PackageFamilyName is registered in good state, skip re-registering it.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Opcode
Info

Description

PackageFamilyName is registered in good state, skip re-registering it.

Message #

%1 is registered in good state, skip re-registering it

Fields #

NameDescription
PackageFamilyName UnicodeString—

Event ID 326 — Determining packages to be installed during logon for user: UserSid.

#
Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Level
Verbose
Opcode
Info

Description

Determining packages to be installed during logon for user: UserSid.

Message #

Determining packages to be installed during logon for user: %1.

Fields #

NameDescription
UserSid UnicodeStringDetermining packages to be installed during logon for user.
IsSpecialUserProfile Boolean—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment",
    "guid": "8127F6D4-59F9-4ABF-8952-3E3A02073D5F",
    "event_source_name": "",
    "event_id": 326,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427453440,
    "time_created": "2023-11-06T06:25:42.557627+00:00",
    "event_record_id": 21,
    "correlation": {},
    "execution": {
      "process_id": 1864,
      "thread_id": 3472
    },
    "channel": "Microsoft-Windows-AppXDeployment/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "UserSid": "",
    "IsSpecialUserProfile": false
  },
  "message": ""
}

References #

Event ID 327 — The following packages will be installed: InstallPackageList.

#
Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Level
Verbose
Opcode
Info

Description

The following packages will be installed: InstallPackageList. The following packages will be removed: RemovePackageList.

Message #

The following packages will be installed: %1. The following packages will be removed: %2

Fields #

NameDescription
InstallPackageList UnicodeStringThe following packages will be installed.
RemovePackageList UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment",
    "guid": "8127F6D4-59F9-4ABF-8952-3E3A02073D5F",
    "event_source_name": "",
    "event_id": 327,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427453440,
    "time_created": "2023-11-06T06:25:51.768104+00:00",
    "event_record_id": 22,
    "correlation": {},
    "execution": {
      "process_id": 1864,
      "thread_id": 3472
    },
    "channel": "Microsoft-Windows-AppXDeployment/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InstallPackageList": "Microsoft.Windows.CloudExperienceHost_10.0.22621.2361_neutral_neutral_cw5n1h2txyewy Microsoft.BioEnrollment_10.0.19587.1000_neutral_neutral_cw5n1h2txyewy Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral_neutral_cw5n1h2txyewy MicrosoftWindows.UndockedDevKit_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.UI.Xaml.CBS_8.2305.16002.0_neutral_neutral_8wekyb3d8bbwe MicrosoftWindows.Client.Core_1000.22643.1000.0_x64__cw5n1h2txyewy MicrosoftWindows.Client.CBS_1000.22674.1000.0_x64__cw5n1h2txyewy Microsoft.Windows.StartMenuExperienceHost_10.0.22621.2215_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.ShellExperienceHost_10.0.22621.2215_neutral_neutral_cw5n1h2txyewy windows.immersivecontrolpanel_10.0.6.1000_neutral_neutral_cw5n1h2txyewy Microsoft.549981C3F5F10_3.2204.14815.0_neutral_~_8wekyb3d8bbwe CanonicalGroupLimited.UbuntuonWindows_2004.2022.1.0_neutral_~_79rhkp1fndgsc Clipchamp.Clipchamp_2.2.8.0_neutral_~_yxz26nhyzhsrt Microsoft.DesktopAppInstaller_2023.1005.18.0_neutral_~_8wekyb3d8bbwe Microsoft.GamingApp_2021.427.138.0_neutral_~_8wekyb3d8bbwe Microsoft.GetHelp_10.2201.421.0_neutral_~_8wekyb3d8bbwe Microsoft.Getstarted_2021.2204.1.0_neutral_~_8wekyb3d8bbwe Microsoft.HEIFImageExtension_1.0.43012.0_x64__8wekyb3d8bbwe Microsoft.HEVCVideoExtension_1.0.50361.0_x64__8wekyb3d8bbwe Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe Microsoft.MicrosoftStickyNotes_4.2.2.0_neutral_~_8wekyb3d8bbwe Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x86__8wekyb3d8bbwe Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x86__8wekyb3d8bbwe Microsoft.Paint_11.2308.30.0_neutral_~_8wekyb3d8bbwe Microsoft.PowerAutomateDesktop_10.0.3735.0_neutral_~_8wekyb3d8bbwe Microsoft.RawImageExtension_2.1.30391.0_neutral_~_8wekyb3d8bbwe Microsoft.ScreenSketch_2022.2201.12.0_neutral_~_8wekyb3d8bbwe Microsoft.SecHealthUI_1000.25873.9001.0_x64__8wekyb3d8bbwe Microsoft.StorePurchaseApp_12008.1001.113.0_neutral_~_8wekyb3d8bbwe Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe Microsoft.UI.Xaml.2.7_7.2208.15002.0_x64__8wekyb3d8bbwe Microsoft.UI.Xaml.2.7_7.2208.15002.0_x86__8wekyb3d8bbwe Microsoft.UI.Xaml.2.8_8.2306.22001.0_x64__8wekyb3d8bbwe Microsoft.UI.Xaml.2.8_8.2306.22001.0_x86__8wekyb3d8bbwe Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x64__8wekyb3d8bbwe Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x86__8wekyb3d8bbwe Microsoft.VCLibs.140.00_14.0.32530.0_x64__8wekyb3d8bbwe Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe Microsoft.VP9VideoExtensions_1.0.50901.0_x64__8wekyb3d8bbwe Microsoft.WebMediaExtensions_1.0.42192.0_neutral_~_8wekyb3d8bbwe Microsoft.WebpImageExtension_1.0.42351.0_x64__8wekyb3d8bbwe Microsoft.Windows.Photos_21.21030.25003.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsAlarms_2022.2202.24.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsCalculator_2021.2307.4.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsCamera_2022.2201.4.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsFeedbackHub_2023.504.1552.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsNotepad_11.2307.27.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsSoundRecorder_2021.2103.28.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsStore_22309.1401.2.0_neutral_~_8wekyb3d8bbwe Microsoft.WindowsTerminal_3001.18.2822.0_neutral_~_8wekyb3d8bbwe Microsoft.Xbox.TCUI_1.23.28004.0_neutral_~_8wekyb3d8bbwe Microsoft.XboxGameOverlay_1.47.2385.0_neutral_~_8wekyb3d8bbwe Microsoft.XboxGamingOverlay_2.622.3232.0_neutral_~_8wekyb3d8bbwe Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe MicrosoftCorporationII.QuickAssist_2022.414.1758.0_neutral_~_8wekyb3d8bbwe MicrosoftWindows.Client.WebExperience_423.23500.0.0_neutral_~_cw5n1h2txyewy 1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.22621.1_neutral_neutral_cw5n1h2txyewy E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.AccountsControl_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.AsyncTextService_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe Microsoft.CredDialogHost_10.0.19595.1001_neutral_neutral_cw5n1h2txyewy Microsoft.ECApp_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe Microsoft.LockApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.MicrosoftEdgeDevToolsClient_10.0.22621.1_neutral__8wekyb3d8bbwe Microsoft.Win32WebViewHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.AppRep.ChxApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.AssignedAccessLockApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.CallingShellApp_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.ContentDeliveryManager_10.0.22621.2361_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.NarratorQuickStart_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe Microsoft.Windows.ParentalControls_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.PeopleExperienceHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.PinningConfirmationDialog_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.PrintQueueActionCenter_1.0.1.0_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.SecureAssessmentBrowser_10.0.22621.900_neutral_neutral_cw5n1h2txyewy Microsoft.Windows.XGpuEjectDialog_10.0.22621.1_neutral_neutral_cw5n1h2txyewy Microsoft.WindowsAppRuntime.CBS_4000.1000.1727.0_x64__8wekyb3d8bbwe Microsoft.XboxGameCallableUI_10.0.22621.1_neutral_neutral_cw5n1h2txyewy MicrosoftWindows.Client.FileExp_1000.22651.1000.0_x64__cw5n1h2txyewy NcsiUwpApp_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy Windows.PrintDialog_6.2.2.0_neutral_neutral_cw5n1h2txyewy ",
    "RemovePackageList": "NULL"
  },
  "message": ""
}

References #

Event ID 328 — Unable to determine packages to be installed during logon with error: ErrorCode.

#
Provider
Microsoft-Windows-AppXDeployment
Channel
Operational
Level
Error
Opcode
Info

Description

Unable to determine packages to be installed during logon with error: ErrorCode.

Message #

Unable to determine packages to be installed during logon with error: %1.

Fields #

NameDescription
ErrorCode HexInt32Unable to determine packages to be installed during logon with error.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment",
    "guid": "8127F6D4-59F9-4ABF-8952-3E3A02073D5F",
    "event_source_name": "",
    "event_id": 328,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427453440,
    "time_created": "2023-10-25T22:52:41.304385+00:00",
    "event_record_id": 18,
    "correlation": {
      "ActivityID": "61A55000-55E5-1017-0000-000000000000"
    },
    "execution": {
      "process_id": 536,
      "thread_id": 796
    },
    "channel": "Microsoft-Windows-AppXDeployment/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorCode": "0x800401f0"
  },
  "message": ""
}

References #

Event ID 329 — User Profile created for UserSid with path ProfilePath and type ProfileType.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational

Description

User Profile created for UserSid with path ProfilePath and type ProfileType.

Message #

User Profile created for %1 with path %2 and type %3.

Fields #

NameDescription
UserSid UnicodeString—
ProfilePath UnicodeString—
ProfileType HexInt32—

Event ID 330 — User Profile deleted for UserSid with path ProfilePath and type ProfileType.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational

Description

User Profile deleted for UserSid with path ProfilePath and type ProfileType.

Message #

User Profile deleted for %1 with path %2 and type %3.

Fields #

NameDescription
UserSid UnicodeString—
ProfilePath UnicodeString—
ProfileType HexInt32—

Event ID 331 — Outdated packages registered to user UserSid: OutdatedPackages.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational

Description

Outdated packages registered to user UserSid: OutdatedPackages. Corresponding up-to-date packages: UpToDatePackages.

Message #

Outdated packages registered to user %1: %2. Corresponding up-to-date packages: %3

Fields #

NameDescription
UserSid UnicodeString—
OutdatedPackages UnicodeString—
UpToDatePackages UnicodeString—

Event ID 332 — Deployment operation deploymentOperation on mainParam with options deploymentOptions and calling process callerProcess with callstack callstack.

Provider
Microsoft-Windows-AppXDeployment
Channel
Operational

Description

Deployment operation deploymentOperation on mainParam with options deploymentOptions and calling process callerProcess with callstack callstack.

Message #

Deployment operation %2 on %1 with options %3 and calling process %4 with callstack %5

Fields #

NameDescription
mainParam UnicodeString—
deploymentOperation UInt32—
deploymentOptions HexInt64—
callerProcess UnicodeString—
callstack UnicodeString—

Event ID 1001 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.ServiceStartup
Opcode
Start

Event ID 1002 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.ServiceStartup

Event ID 1003 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.ServiceStartup
Opcode
Stop

Event ID 1004 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.AddPackage
Opcode
Start

Event ID 1005 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.AddPackage
Opcode
Stop

Event ID 1006 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.RemovePackage
Opcode
Start

Event ID 1007 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.RemovePackage
Opcode
Stop

Event ID 1008 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1009 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1010 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1011 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1012 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1013 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1014 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1015 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1016 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1017 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1018 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1019 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1020 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Start

Event ID 1021 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Stop

Event ID 1022 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Start

Event ID 1023 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Stop

Event ID 1024 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Start

Event ID 1025 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Stop

Event ID 1026 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1027 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1028 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1029 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1030 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1031 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1032 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1033 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Fields #

NameDescription
ErrorCode HexInt32—

Event ID 1034 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Start

Event ID 1035 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Stop

Event ID 1036 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1037 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1038 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1039 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1040 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1041 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1042 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1043 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1044 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1045 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1046 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1047 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1048 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Start

Event ID 1049 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Stop

Event ID 1050 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Start

Event ID 1051 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Stop

Event ID 1052 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Start

Event ID 1053 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Stop

Event ID 1054 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Start

Event ID 1055 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.EnumAPI
Opcode
Stop

Event ID 1056 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1057 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1058 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1059 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop

Event ID 1060 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Start

Event ID 1061 —

Provider
Microsoft-Windows-AppXDeployment
Channel
Diagnostic
Task
AppXDeployment.Task.Client.Deployment
Opcode
Stop