detection.wiki

Microsoft-Windows-AssignedAccessBroker

12 events across 1 channel

Event IDTitleChannel
30000Activated above lock app AboveLockAppAUMID using interface InterfaceType with …Admin
30002Could not find any application running above lockAdmin
30003Above lock app exited with result code Result.Admin
30004This is a custom event, see details for more informationAdmin
30005Failed to get Interface with return code HResult.Admin
30006Detected unlocking event (user pressed Ctrl+Alt+Del), terminating above lock …Admin
30007Interface failed with return code HResult.Admin
30008Abovelock toast operation Operation failed with return code HResult.Admin
30009Set PowerRequestActiveLockScreenInternal request action RequestAction, returns …Admin
30010Close power request handle returns Result.Admin
30011Above lock app is unresponsiveAdmin
30012Edge downloads path has been redirectedAdmin

Event ID 30000 — Activated above lock app AboveLockAppAUMID using interface InterfaceType with return code HResult.

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
ActivateAssignedAccessApplication

Description

Activated above lock app AboveLockAppAUMID using interface InterfaceType with return code HResult.

Message #

Activated above lock app %1 using interface %2 with return code %3

Fields #

NameDescription
AboveLockAppAUMID UnicodeString—
InterfaceType UnicodeString—
HResult HexInt32—

Event ID 30002 — Could not find any application running above lock

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
WaitForAssignedAccessApplicationToDie

Description

Could not find any application running above lock.

Message #

Could not find any application running above lock

Event ID 30003 — Above lock app exited with result code Result.

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
WaitForAssignedAccessApplicationToDie

Description

Above lock app exited with result code Result.

Message #

Above lock app exited with result code %1

Fields #

NameDescription
Result Boolean—

Event ID 30004 — This is a custom event, see details for more information

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
CustomTask

Description

This is a custom event, see details for more information.

Message #

This is a custom event, see details for more information

Fields #

NameDescription
CustomMessage UnicodeString—
HResult HexInt32—
Address Pointer—

Event ID 30005 — Failed to get Interface with return code HResult.

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
LockFrameworkQueryTask

Description

Failed to get Interface with return code HResult.

Message #

Failed to get %1 with return code %2

Fields #

NameDescription
Interface UnicodeString—
HResult HexInt32—

Event ID 30006 — Detected unlocking event (user pressed Ctrl+Alt+Del), terminating above lock app, and exiting lock app

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
UnlockTask

Description

Detected unlocking event (user pressed Ctrl+Alt+Del), terminating above lock app, and exiting lock app.

Message #

Detected unlocking event (user pressed Ctrl+Alt+Del), terminating above lock app, and exiting lock app

Event ID 30007 — Interface failed with return code HResult.

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
LockAppPidTask

Description

Interface failed with return code HResult.

Message #

%1 failed with return code %2

Fields #

NameDescription
Interface UnicodeString—
HResult HexInt32—

Event ID 30008 — Abovelock toast operation Operation failed with return code HResult.

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
AbovelockToastTask

Description

Abovelock toast operation Operation failed with return code HResult.

Message #

Abovelock toast operation %1 failed with return code %2

Fields #

NameDescription
Operation UnicodeString—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
HResult HexInt32—

Event ID 30009 — Set PowerRequestActiveLockScreenInternal request action RequestAction, returns code HResult.

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
SetPowerManagerStatusTask

Description

Set PowerRequestActiveLockScreenInternal request action RequestAction, returns code HResult.

Message #

Set PowerRequestActiveLockScreenInternal request action %1, returns code %2

Fields #

NameDescription
RequestAction Boolean—
HResult HexInt32—

Event ID 30010 — Close power request handle returns Result.

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
ClosePowerRequestHandleTask

Description

Close power request handle returns Result.

Message #

Close power request handle returns %1

Fields #

NameDescription
Result Boolean—

Event ID 30011 — Above lock app is unresponsive

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
ReportUnresponsiveAssignedAccessApplication

Description

Above lock app is unresponsive.

Message #

Above lock app is unresponsive

Event ID 30012 — Edge downloads path has been redirected

Provider
Microsoft-Windows-AssignedAccessBroker
Channel
Admin
Task
AppSpecificSettingsTask

Description

Edge downloads path has been redirected.

Message #

Edge downloads path has been redirected