Microsoft-Windows-Backup
133 events across 2 channels
Event ID 1 — The backup operation has started.
Event ID 2 — The backup catalog is corrupted.
Description
The backup catalog is corrupted. Please recover the catalog from a backup using the Windows Server Backup snap-in or the WBADMIN RESTORE CATALOG command.
Message #
Event ID 3 — The backup catalog on the selected disk 'TargetDeviceName' is corrupted so that you will not be able to perform a recovery operation from this location.
Event ID 4 — The backup operation has finished successfully.
Description
The backup operation has finished successfully.
Message #
Fields #
| Name | Description |
|---|---|
BackupTemplateID GUID | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupState Int32 | — |
BackupTime FILETIME | — |
BackupTarget UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
SourceSnapStartTime FILETIME | — |
SourceSnapEndTime FILETIME | — |
PrepareBackupStartTime UnicodeString | — |
PrepareBackupEndTime UnicodeString | — |
BackupWriteStartTime UnicodeString | — |
BackupWriteEndTime UnicodeString | — |
TargetSnapStartTime FILETIME | — |
TargetSnapEndTime FILETIME | — |
DVDFormatStartTime UnicodeString | — |
DVDFormatEndTime UnicodeString | — |
MediaVerifyStartTime UnicodeString | — |
MediaVerifyEndTime UnicodeString | — |
BackupPreviousState Int32 | — |
ComponentStatus UnicodeString | — |
ComponentInfo UnicodeString | — |
SSBEnumerateStartTime FILETIME | — |
SSBEnumerateEndTime FILETIME | — |
SSBVhdCreationStartTime FILETIME | — |
SSBVhdCreationEndTime FILETIME | — |
SSBBackupStartTime FILETIME | — |
SSBBackupEndTime FILETIME | — |
SystemStateBackup UnicodeString | — |
BMR UnicodeString | — |
VssFullBackup Boolean | — |
UserInputBMR Boolean | — |
UserInputSSB Boolean | — |
BackupSuccessLogPath UnicodeString | — |
BackupFailureLogPath UnicodeString | — |
EnumerateBackupStartTime UnicodeString | — |
EnumerateBackupEndTime UnicodeString | — |
PruneBackupStartTime UnicodeString | — |
PruneBackupEndTime UnicodeString | — |
BackupFlags HexInt32 | — |
ComponentInfoSummary UnicodeString | — |
Event ID 5 — The backup operation that started at 'BackupTime' has failed with following error code 'HRESULT'.
Description
The backup operation that started at 'BackupTime' has failed with following error code 'HRESULT'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
BackupTemplateID GUID | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupState Int32 | — |
BackupTime FILETIME | — |
BackupTarget UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
SourceSnapStartTime FILETIME | — |
SourceSnapEndTime FILETIME | — |
PrepareBackupStartTime UnicodeString | — |
PrepareBackupEndTime UnicodeString | — |
BackupWriteStartTime UnicodeString | — |
BackupWriteEndTime UnicodeString | — |
TargetSnapStartTime FILETIME | — |
TargetSnapEndTime FILETIME | — |
DVDFormatStartTime UnicodeString | — |
DVDFormatEndTime UnicodeString | — |
MediaVerifyStartTime UnicodeString | — |
MediaVerifyEndTime UnicodeString | — |
BackupPreviousState Int32 | — |
ComponentStatus UnicodeString | — |
ComponentInfo UnicodeString | — |
SSBEnumerateStartTime FILETIME | — |
SSBEnumerateEndTime FILETIME | — |
SSBVhdCreationStartTime FILETIME | — |
SSBVhdCreationEndTime FILETIME | — |
SSBBackupStartTime FILETIME | — |
SSBBackupEndTime FILETIME | — |
SystemStateBackup UnicodeString | — |
BMR UnicodeString | — |
VssFullBackup Boolean | — |
UserInputBMR Boolean | — |
UserInputSSB Boolean | — |
BackupSuccessLogPath UnicodeString | — |
BackupFailureLogPath UnicodeString | — |
EnumerateBackupStartTime UnicodeString | — |
EnumerateBackupEndTime UnicodeString | — |
PruneBackupStartTime UnicodeString | — |
PruneBackupEndTime UnicodeString | — |
BackupFlags HexInt32 | — |
ComponentInfoSummary UnicodeString | — |
Event ID 6 — The backup operation has failed because another backup or recovery operation is in progress.
Description
The backup operation has failed because another backup or recovery operation is in progress. Please stop the conflicting operation, and then rerun the backup operation.
Message #
Event ID 7 — The backup operation that started at 'BackupTime' has completed with errors.
Description
The backup operation that started at 'BackupTime' has completed with errors. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
BackupTemplateID GUID | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupState Int32 | — |
BackupTime FILETIME | — |
BackupTarget UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
SourceSnapStartTime FILETIME | — |
SourceSnapEndTime FILETIME | — |
PrepareBackupStartTime UnicodeString | — |
PrepareBackupEndTime UnicodeString | — |
BackupWriteStartTime UnicodeString | — |
BackupWriteEndTime UnicodeString | — |
TargetSnapStartTime FILETIME | — |
TargetSnapEndTime FILETIME | — |
DVDFormatStartTime UnicodeString | — |
DVDFormatEndTime UnicodeString | — |
MediaVerifyStartTime UnicodeString | — |
MediaVerifyEndTime UnicodeString | — |
BackupPreviousState Int32 | — |
ComponentStatus UnicodeString | — |
ComponentInfo UnicodeString | — |
SSBEnumerateStartTime FILETIME | — |
SSBEnumerateEndTime FILETIME | — |
SSBVhdCreationStartTime FILETIME | — |
SSBVhdCreationEndTime FILETIME | — |
SSBBackupStartTime FILETIME | — |
SSBBackupEndTime FILETIME | — |
SystemStateBackup UnicodeString | — |
BMR UnicodeString | — |
VssFullBackup Boolean | — |
UserInputBMR Boolean | — |
UserInputSSB Boolean | — |
BackupSuccessLogPath UnicodeString | — |
BackupFailureLogPath UnicodeString | — |
EnumerateBackupStartTime UnicodeString | — |
EnumerateBackupEndTime UnicodeString | — |
PruneBackupStartTime UnicodeString | — |
PruneBackupEndTime UnicodeString | — |
BackupFlags HexInt32 | — |
ComponentInfoSummary UnicodeString | — |
Event ID 8 — The backup operation was canceled.
Description
The backup operation was canceled.
Message #
Fields #
| Name | Description |
|---|---|
BackupTemplateID GUID | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupState Int32 | — |
BackupTime FILETIME | — |
BackupTarget UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
SourceSnapStartTime FILETIME | — |
SourceSnapEndTime FILETIME | — |
PrepareBackupStartTime UnicodeString | — |
PrepareBackupEndTime UnicodeString | — |
BackupWriteStartTime UnicodeString | — |
BackupWriteEndTime UnicodeString | — |
TargetSnapStartTime FILETIME | — |
TargetSnapEndTime FILETIME | — |
DVDFormatStartTime UnicodeString | — |
DVDFormatEndTime UnicodeString | — |
MediaVerifyStartTime UnicodeString | — |
MediaVerifyEndTime UnicodeString | — |
BackupPreviousState Int32 | — |
ComponentStatus UnicodeString | — |
ComponentInfo UnicodeString | — |
SSBEnumerateStartTime FILETIME | — |
SSBEnumerateEndTime FILETIME | — |
SSBVhdCreationStartTime FILETIME | — |
SSBVhdCreationEndTime FILETIME | — |
SSBBackupStartTime FILETIME | — |
SSBBackupEndTime FILETIME | — |
SystemStateBackup UnicodeString | — |
BMR UnicodeString | — |
VssFullBackup Boolean | — |
UserInputBMR Boolean | — |
UserInputSSB Boolean | — |
BackupSuccessLogPath UnicodeString | — |
BackupFailureLogPath UnicodeString | — |
EnumerateBackupStartTime UnicodeString | — |
EnumerateBackupEndTime UnicodeString | — |
PruneBackupStartTime UnicodeString | — |
PruneBackupEndTime UnicodeString | — |
BackupFlags HexInt32 | — |
ComponentInfoSummary UnicodeString | — |
Event ID 9 — The backup operation that started at 'BackupStartTime' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being ...
Event ID 10 — There is no backup available on the storage location.
Message #
Event ID 11 — The backup of volume 'VolumeFriendlyName' on the backup storage location is corrupted.
Event ID 12 — The backup has some corrupted application metadata and cannot be used to perform a recovery.
Event ID 13 — The backup operation has completed with warning(s) - Volume 'VolumeFriendlyName' has developed new bad clusters.
Event ID 14 — The backup operation has completed.
Description
The backup operation has completed.
Message #
Fields #
| Name | Description |
|---|---|
BackupTemplateID GUID | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupState Int32 | — |
BackupTime FILETIME | — |
BackupTarget UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
SourceSnapStartTime FILETIME | — |
SourceSnapEndTime FILETIME | — |
PrepareBackupStartTime UnicodeString | — |
PrepareBackupEndTime UnicodeString | — |
BackupWriteStartTime UnicodeString | — |
BackupWriteEndTime UnicodeString | — |
TargetSnapStartTime FILETIME | — |
TargetSnapEndTime FILETIME | — |
DVDFormatStartTime UnicodeString | — |
DVDFormatEndTime UnicodeString | — |
MediaVerifyStartTime UnicodeString | — |
MediaVerifyEndTime UnicodeString | — |
BackupPreviousState Int32 | — |
ComponentStatus UnicodeString | — |
ComponentInfo UnicodeString | — |
SSBEnumerateStartTime FILETIME | — |
SSBEnumerateEndTime FILETIME | — |
SSBVhdCreationStartTime FILETIME | — |
SSBVhdCreationEndTime FILETIME | — |
SSBBackupStartTime FILETIME | — |
SSBBackupEndTime FILETIME | — |
SystemStateBackup UnicodeString | — |
BMR UnicodeString | — |
VssFullBackup Boolean | — |
UserInputBMR Boolean | — |
UserInputSSB Boolean | — |
BackupSuccessLogPath UnicodeString | — |
BackupFailureLogPath UnicodeString | — |
EnumerateBackupStartTime UnicodeString | — |
EnumerateBackupEndTime UnicodeString | — |
PruneBackupStartTime UnicodeString | — |
PruneBackupEndTime UnicodeString | — |
BackupFlags HexInt32 | — |
ComponentInfoSummary UnicodeString | — |
Event ID 15 — The scheduled backup configuration conflicts with current Group Policy settings, error - 'HRESULT'.
Event ID 16 — The backup operation has failed because recovery planning is in progress through some other client.
Message #
Event ID 17 — The backup operation that started at 'BackupTime' has failed because the Windows Server Backup engine could not be contacted, error code 'HRESULT'.
Event ID 18 — The scheduled backup operation that started at 'BackupTime' has failed because the schedule settings were not found.
Event ID 19 — The backup operation attempted at 'NumOfVolumes' has failed to start, error code 'VolumeNames'.
Description
The backup operation attempted at 'NumOfVolumes' has failed to start, error code 'VolumeNames'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
HRESULT HexInt32 | — |
BackupTime FILETIME | — |
BackupTarget UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumeNames UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 20 — The backup operation that started at 'BackupTime' has failed because another backup or recovery operation is in progress.
Description
The backup operation that started at 'BackupTime' has failed because another backup or recovery operation is in progress. Please stop the conflicting operation, and then rerun the backup operation.
Message #
Fields #
| Name | Description |
|---|---|
HRESULT HexInt32 | — |
BackupTime FILETIME | — |
BackupTarget UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumeNames UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 21 — The scheduled backup configuration conflicts with current Group Policy settings, error - 'HRESULT'.
Event ID 22 — The backup operation that started at 'BackupTime' has failed because recovery planning is in progress through some other client.
Event ID 23 — The backup operation that started at 'BackupTime' has encountered errors.
Description
The backup operation that started at 'BackupTime' has encountered errors.
Message #
Fields #
| Name | Description |
|---|---|
BackupTemplateID GUID | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupState Int32 | — |
BackupTime FILETIME | — |
BackupTarget UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
SourceSnapStartTime FILETIME | — |
SourceSnapEndTime FILETIME | — |
PrepareBackupStartTime UnicodeString | — |
PrepareBackupEndTime UnicodeString | — |
BackupWriteStartTime UnicodeString | — |
BackupWriteEndTime UnicodeString | — |
TargetSnapStartTime FILETIME | — |
TargetSnapEndTime FILETIME | — |
DVDFormatStartTime UnicodeString | — |
DVDFormatEndTime UnicodeString | — |
MediaVerifyStartTime UnicodeString | — |
MediaVerifyEndTime UnicodeString | — |
BackupPreviousState Int32 | — |
ComponentStatus UnicodeString | — |
ComponentInfo UnicodeString | — |
SSBEnumerateStartTime FILETIME | — |
SSBEnumerateEndTime FILETIME | — |
SSBVhdCreationStartTime FILETIME | — |
SSBVhdCreationEndTime FILETIME | — |
SSBBackupStartTime FILETIME | — |
SSBBackupEndTime FILETIME | — |
SystemStateBackup UnicodeString | — |
BMR UnicodeString | — |
VssFullBackup Boolean | — |
UserInputBMR Boolean | — |
UserInputSSB Boolean | — |
BackupSuccessLogPath UnicodeString | — |
BackupFailureLogPath UnicodeString | — |
EnumerateBackupStartTime UnicodeString | — |
EnumerateBackupEndTime UnicodeString | — |
PruneBackupStartTime UnicodeString | — |
PruneBackupEndTime UnicodeString | — |
BackupFlags HexInt32 | — |
ComponentInfoSummary UnicodeString | — |
Event ID 24 — Backup started a fresh backup for volume 'VolumeGUID' ('VolumeFriendlyName') : [Reason: 'VhdDeleteReason'].
Event ID 25 — Backup failed for volume 'VolumeGUID' ('VolumeFriendlyName'): [Reason: 'VhdDeleteReason'].
Event ID 49 — The backup operation has failed because no backup storage location could be found.
Description
The backup operation has failed because no backup storage location could be found. Please confirm that the backup storage location is attached and online, and then rerun the backup operation.
Message #
Event ID 50 — The backup operation has failed because the required space was not available on the backup storage location.
Event ID 51 — The backup storage location is running low on free space.
Event ID 52 — The backup operation has failed because the remote shared folder that you are using for a backup storage location is not writeable.
Event ID 53 — Windows Server Backup is waiting for a DVD to be inserted into the drive.
Description
Windows Server Backup is waiting for a DVD to be inserted into the drive.
Message #
Event ID 96 — A scheduled backup has been configured for this computer.
Description
A scheduled backup has been configured for this computer.
Message #
Event ID 97 — The scheduled backup for this computer has been modified.
Description
The scheduled backup for this computer has been modified.
Message #
Event ID 98 — The scheduled backup was canceled.
Description
The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.
Message #
Event ID 99 — A scheduled backup has been configured for this computer.
Event ID 100 — The scheduled backup was canceled.
Description
The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.
Message #
Event ID 144 — A new volume 'VolumeFriendlyName' was detected that is not in the list of volumes to include in the backup.
Description
A new volume 'VolumeFriendlyName' was detected that is not in the list of volumes to include in the backup. Please add it to the scheduled backup configuration if you want to protect this volume.
Message #
Fields #
| Name | Description |
|---|---|
VolumeFriendlyName UnicodeString | — |
VolumeAccessPath UnicodeString | — |
Event ID 146 — A volume 'VolumeFriendlyName' in the list of volumes to include in the backup is missing.
Event ID 160 — The system catalog has been recovered from the backup storage location 'BackupTarget'.
Event ID 161 — The system catalog has been deleted.
Description
The system catalog has been deleted.
Message #
Event ID 192 — The recovery operation has started.
Event ID 193 — The operation to recover volume(s) has completed.
Description
The operation to recover volume(s) has completed.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupTargetFriendlyName UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
PrepareRestoreTime UInt32 | — |
RestoreTime FILETIME | — |
WriteRestoreTime UInt32 | — |
Event ID 194 — The operation to recover volume(s) that started at 'NumOfVolumes' has successfully completed.
Description
The operation to recover volume(s) that started at 'NumOfVolumes' has successfully completed.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupTargetFriendlyName UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
PrepareRestoreTime UInt32 | — |
RestoreTime FILETIME | — |
WriteRestoreTime UInt32 | — |
Event ID 195 — The volume recovery operation has completed with errors.
Description
The volume recovery operation has completed with errors.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupTargetFriendlyName UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
PrepareRestoreTime UInt32 | — |
RestoreTime FILETIME | — |
WriteRestoreTime UInt32 | — |
Event ID 196 — The volume recovery operation has failed with errors.
Description
The volume recovery operation has failed with errors.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupTargetFriendlyName UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
PrepareRestoreTime UInt32 | — |
RestoreTime FILETIME | — |
WriteRestoreTime UInt32 | — |
Event ID 197 — The operation to recover volume(s) that started at 'NumOfVolumes' was canceled.
Description
The operation to recover volume(s) that started at 'NumOfVolumes' was canceled.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
ErrorMessage UnicodeString | — |
BackupTargetFriendlyName UnicodeString | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
PrepareRestoreTime UInt32 | — |
RestoreTime FILETIME | — |
WriteRestoreTime UInt32 | — |
Event ID 198 — The operation to recover volume 'VolumeFriendlyName' has failed or was canceled.
Description
The operation to recover volume 'VolumeFriendlyName' has failed or was canceled. The volume may now be corrupted and may need to be reformatted. Run CHKDSK /R on the volume to look for corrupted sectors.
Message #
Fields #
| Name | Description |
|---|---|
VolumeFriendlyName UnicodeString | — |
VolumeAccessPath UnicodeString | — |
Event ID 199 — The operation to recover 'VolumeFriendlyName' has failed because the volume that you are recovering to is too small.
Event ID 208 — The operation to recover file(s) has completed.
Description
The operation to recover file(s) has completed.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
FileRestoreTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
NumOfFiles UInt32 | — |
FilesInfo UnicodeString | — |
RestoreTime FILETIME | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
MountVhdTime UInt32 | — |
PreparePassTime UInt32 | — |
WriteFilesTime UInt32 | — |
BackupLocation UnicodeString | — |
TotalDataTransferred UInt64 | — |
Event ID 209 — The recovery operation of file(s) that started at 'RestoreTime' completed successfully.
Description
The recovery operation of file(s) that started at 'RestoreTime' completed successfully.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
RestoreEventId GUID | — |
FileRestoreTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT UInt32 | — |
DetailedHRESULT UInt32 | — |
NumOfFiles UInt32 | — |
FilesInfo UnicodeString | — |
RestoreTime FILETIME | — |
MountVhdTime UInt32 | — |
PreparePassTime UInt32 | — |
WriteFilesTime UInt32 | — |
Event ID 210 — The file recovery operation completed with errors.
Description
The file recovery operation completed with errors. One or more files may not have been recovered correctly.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
RestoreEventId GUID | — |
FileRestoreTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT UInt32 | — |
DetailedHRESULT UInt32 | — |
NumOfFiles UInt32 | — |
FilesInfo UnicodeString | — |
RestoreTime FILETIME | — |
MountVhdTime UInt32 | — |
PreparePassTime UInt32 | — |
WriteFilesTime UInt32 | — |
Event ID 211 — The file recovery operation failed with errors.
Description
The file recovery operation failed with errors.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
RestoreEventId GUID | — |
FileRestoreTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT UInt32 | — |
DetailedHRESULT UInt32 | — |
NumOfFiles UInt32 | — |
FilesInfo UnicodeString | — |
RestoreTime FILETIME | — |
MountVhdTime UInt32 | — |
PreparePassTime UInt32 | — |
WriteFilesTime UInt32 | — |
Event ID 212 — The recovery operation of file(s) that started at 'RestoreTime' was canceled.
Description
The recovery operation of file(s) that started at 'RestoreTime' was canceled.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
RestoreEventId GUID | — |
FileRestoreTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT UInt32 | — |
DetailedHRESULT UInt32 | — |
NumOfFiles UInt32 | — |
FilesInfo UnicodeString | — |
RestoreTime FILETIME | — |
MountVhdTime UInt32 | — |
PreparePassTime UInt32 | — |
WriteFilesTime UInt32 | — |
Event ID 213 — The backup set of volume 'VolumeToMount' on the backup storage location has been loaded.
Event ID 214 — The operation to recover file(s) started at 'RestoreTime' has completed successfully.
Description
The operation to recover file(s) started at 'RestoreTime' has completed successfully. Log of files successfully recovered 'FileSuccessLogPath'.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
FileRestoreTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
NumOfFiles UInt32 | — |
FilesInfo UnicodeString | — |
RestoreTime FILETIME | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
MountVhdTime UInt32 | — |
PreparePassTime UInt32 | — |
WriteFilesTime UInt32 | — |
BackupLocation UnicodeString | — |
TotalDataTransferred UInt64 | — |
Event ID 215 — The file recovery operation has completed with errors.
Description
The file recovery operation has completed with errors. One or more files may not have been recovered correctly. Log of files successfully recovered ''. Log of files not successfully recovered ''.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
FileRestoreTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
NumOfFiles UInt32 | — |
FilesInfo UnicodeString | — |
RestoreTime FILETIME | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
MountVhdTime UInt32 | — |
PreparePassTime UInt32 | — |
WriteFilesTime UInt32 | — |
BackupLocation UnicodeString | — |
TotalDataTransferred UInt64 | — |
Event ID 216 — The file recovery operation has failed with errors.
Description
The file recovery operation has failed with errors. Log of files not successfully recovered 'FileFailureLogPath'.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
FileRestoreTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
NumOfFiles UInt32 | — |
FilesInfo UnicodeString | — |
RestoreTime FILETIME | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
MountVhdTime UInt32 | — |
PreparePassTime UInt32 | — |
WriteFilesTime UInt32 | — |
BackupLocation UnicodeString | — |
TotalDataTransferred UInt64 | — |
Event ID 217 — The operation to recover file(s) that started at 'RestoreTime' was canceled.
Description
The operation to recover file(s) that started at 'RestoreTime' was canceled.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
FileRestoreTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
NumOfFiles UInt32 | — |
FilesInfo UnicodeString | — |
RestoreTime FILETIME | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
MountVhdTime UInt32 | — |
PreparePassTime UInt32 | — |
WriteFilesTime UInt32 | — |
BackupLocation UnicodeString | — |
TotalDataTransferred UInt64 | — |
Event ID 224 — The operation to recover component(s) has completed.
Description
The operation to recover component(s) has completed.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 225 — The operation to recover component(s) that started at 'RestoreTime' has completed successfully.
Description
The operation to recover component(s) that started at 'RestoreTime' has completed successfully.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 226 — The operation to recover component(s) has completed with errors.
Description
The operation to recover component(s) has completed with errors. One or more components may not have been recovered correctly.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 227 — The operation to recover component(s) has failed with errors.
Description
The operation to recover component(s) has failed with errors.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 228 — The operation to recover component(s) that started at 'RestoreTime' was canceled.
Description
The operation to recover component(s) that started at 'RestoreTime' was canceled.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 240 — The system state recovery operation started at 'RestoreTime'.
Event ID 241 — The system state recovery operation has completed.
Description
The system state recovery operation has completed.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTime FILETIME | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreType UInt32 | — |
SysvolRestoreType UInt32 | — |
BackupSetID GUID | — |
BackupSetTime FILETIME | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
NumOfWriters UInt32 | — |
WritersInfo UnicodeString | — |
NoOfFilesProcessed UInt64 | — |
NoOfFilesFailed UInt64 | — |
NoOfBytesProcessed UInt64 | — |
TotalNumOfBytes UInt64 | — |
EnumerateStartTime FILETIME | — |
EnumerateEndTime FILETIME | — |
RestoreStartTime FILETIME | — |
RestoreEndTime FILETIME | — |
DeleteStartTime FILETIME | — |
DeleteEndTime FILETIME | — |
RestoreSuccessLogPath UnicodeString | — |
RestoreFailureLogPath UnicodeString | — |
RestoreCLIOutputLogPath UnicodeString | — |
TargetAccessPath UnicodeString | — |
AlternateRecoveryPath UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 242 — The system state recovery operation that started at 'RestoreTime' has completed successfully.
Description
The system state recovery operation that started at 'RestoreTime' has completed successfully. Log of the files successfully recovered: 'RestoreSuccessLogPath'.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTime FILETIME | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreType UInt32 | — |
SysvolRestoreType UInt32 | — |
BackupSetID GUID | — |
BackupSetTime FILETIME | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
NumOfWriters UInt32 | — |
WritersInfo UnicodeString | — |
NoOfFilesProcessed UInt64 | — |
NoOfFilesFailed UInt64 | — |
NoOfBytesProcessed UInt64 | — |
TotalNumOfBytes UInt64 | — |
EnumerateStartTime FILETIME | — |
EnumerateEndTime FILETIME | — |
RestoreStartTime FILETIME | — |
RestoreEndTime FILETIME | — |
DeleteStartTime FILETIME | — |
DeleteEndTime FILETIME | — |
RestoreSuccessLogPath UnicodeString | — |
RestoreFailureLogPath UnicodeString | — |
RestoreCLIOutputLogPath UnicodeString | — |
TargetAccessPath UnicodeString | — |
AlternateRecoveryPath UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 243 — The system state recovery operation that started at 'RestoreTime' has failed with errors.
Description
The system state recovery operation that started at 'RestoreTime' has failed with errors. Log of files successfully recovered 'RestoreSuccessLogPath'. Log of files not successfully recovered 'RestoreFailureLogPath'.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTime FILETIME | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreType UInt32 | — |
SysvolRestoreType UInt32 | — |
BackupSetID GUID | — |
BackupSetTime FILETIME | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
NumOfWriters UInt32 | — |
WritersInfo UnicodeString | — |
NoOfFilesProcessed UInt64 | — |
NoOfFilesFailed UInt64 | — |
NoOfBytesProcessed UInt64 | — |
TotalNumOfBytes UInt64 | — |
EnumerateStartTime FILETIME | — |
EnumerateEndTime FILETIME | — |
RestoreStartTime FILETIME | — |
RestoreEndTime FILETIME | — |
DeleteStartTime FILETIME | — |
DeleteEndTime FILETIME | — |
RestoreSuccessLogPath UnicodeString | — |
RestoreFailureLogPath UnicodeString | — |
RestoreCLIOutputLogPath UnicodeString | — |
TargetAccessPath UnicodeString | — |
AlternateRecoveryPath UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 244 — The system state recovery operation that started at 'RestoreTime' has failed with errors.
Description
The system state recovery operation that started at 'RestoreTime' has failed with errors. Log of files successfully recovered 'RestoreSuccessLogPath'. Log of files not successfully recovered 'RestoreFailureLogPath'.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTime FILETIME | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreType UInt32 | — |
SysvolRestoreType UInt32 | — |
BackupSetID GUID | — |
BackupSetTime FILETIME | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
NumOfWriters UInt32 | — |
WritersInfo UnicodeString | — |
NoOfFilesProcessed UInt64 | — |
NoOfFilesFailed UInt64 | — |
NoOfBytesProcessed UInt64 | — |
TotalNumOfBytes UInt64 | — |
EnumerateStartTime FILETIME | — |
EnumerateEndTime FILETIME | — |
RestoreStartTime FILETIME | — |
RestoreEndTime FILETIME | — |
DeleteStartTime FILETIME | — |
DeleteEndTime FILETIME | — |
RestoreSuccessLogPath UnicodeString | — |
RestoreFailureLogPath UnicodeString | — |
RestoreCLIOutputLogPath UnicodeString | — |
TargetAccessPath UnicodeString | — |
AlternateRecoveryPath UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 245 — The system state recovery operation that started at 'RestoreTime' was canceled.
Description
The system state recovery operation that started at 'RestoreTime' was canceled.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTime FILETIME | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreType UInt32 | — |
SysvolRestoreType UInt32 | — |
BackupSetID GUID | — |
BackupSetTime FILETIME | — |
NumOfVolumes UInt32 | — |
VolumesInfo UnicodeString | — |
NumOfWriters UInt32 | — |
WritersInfo UnicodeString | — |
NoOfFilesProcessed UInt64 | — |
NoOfFilesFailed UInt64 | — |
NoOfBytesProcessed UInt64 | — |
TotalNumOfBytes UInt64 | — |
EnumerateStartTime FILETIME | — |
EnumerateEndTime FILETIME | — |
RestoreStartTime FILETIME | — |
RestoreEndTime FILETIME | — |
DeleteStartTime FILETIME | — |
DeleteEndTime FILETIME | — |
RestoreSuccessLogPath UnicodeString | — |
RestoreFailureLogPath UnicodeString | — |
RestoreCLIOutputLogPath UnicodeString | — |
TargetAccessPath UnicodeString | — |
AlternateRecoveryPath UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 514 — The backup catalog is corrupted.
Description
The backup catalog is corrupted. Please recover the catalog from a backup using the Windows Server Backup snap-in or the 'WBADMIN RESTORE CATALOG' command.
Message #
Event ID 517 — The backup operation that started at 'BackupTime' has failed with following error code 'ErrorCode' (ErrorMessage).
Description
The backup operation that started at '' has failed with following error code '' (). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
BackupTime FILETIME | — |
ErrorCode HexInt32 | — |
ErrorMessage UnicodeString | — |
Event ID 518 — The backup operation that started at 'BackupTime' has failed because another backup or recovery operation is in progress.
Description
The backup operation that started at 'BackupTime' has failed because another backup or recovery operation is in progress. Please stop the conflicting operation, and then rerun the backup operation.
Message #
Fields #
| Name | Description |
|---|---|
BackupTime FILETIME | — |
ErrorCode UInt32 | — |
ErrorMessage UnicodeString | — |
Event ID 519 — The backup operation that started at 'BackupTime' has failed to back up volume(s) 'FailedVolumeNames'.
Description
The backup operation that started at 'BackupTime' has failed to back up volume(s) 'FailedVolumeNames'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
BackupTime FILETIME | — |
FailedVolumeNames UnicodeString | — |
ErrorCode HexInt32 | — |
ErrorMessage UnicodeString | — |
Event ID 521 — The backup operation that started at 'BackupTime' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being ...
Event ID 522 — There is no backup available on the storage location 'BackupTargetFriendlyName'.
Event ID 523 — The system catalog has been recovered from the backup storage location 'BackupTarget'.
Event ID 524 — The system catalog has been deleted.
Description
The system catalog has been deleted.
Message #
Detection Rules #
View all rules referencing this event →
Sigma # view in reference
- Backup Catalog Deleted source medium: Detects backup catalog deletions
Event ID 525 — The backup operation that completed with warning(s) - Volume 'VolumeFriendlyName' has developed new bad clusters.
Event ID 526 — The scheduled backup configuration conflicts with current Group Policy settings, error - 'ErrorCode'.
Event ID 527 — The backup operation that started at 'BackupTime' has failed because recovery planning is in progress through some other client.
Event ID 528 — The scheduled backup configuration conflicts with current Group Policy settings, error - 'ErrorCode'.
Event ID 544 — The backup operation that started at 'BackupTime' has failed because the Windows Server Backup engine could not be contacted, error code 'ErrorCode'.
Event ID 545 — The scheduled backup operation that started at 'BackupTime' has failed because the schedule settings were not found.
Event ID 546 — The backup operation attempted at 'BackupTime' has failed to start, error code 'ErrorCode' (ErrorMessage).
Description
The backup operation attempted at 'BackupTime' has failed to start, error code 'ErrorCode' (ErrorMessage). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
BackupTime FILETIME | — |
ErrorCode UInt32 | — |
ErrorMessage UnicodeString | — |
Event ID 547 — The backup operation that started at 'BackupTime' has encountered errors for the volume(s) 'FailedVolumeNames'.
Description
The backup operation that started at 'BackupTime' has encountered errors for the volume(s) 'FailedVolumeNames'. Log of files not successfully backed up 'BackupFailureLogPath'.
Message #
Fields #
| Name | Description |
|---|---|
BackupTime FILETIME | — |
FailedVolumeNames UnicodeString | — |
BackupFailureLogPath UnicodeString | — |
Event ID 561 — The backup operation that started at 'BackupTime' has failed because no backup storage location could be found.
Event ID 564 — The backup operation that started at 'BackupTime' has failed because the remote shared folder 'BackupTargetFriendlyName' that you are using for a backup storage location is not ...
Event ID 565 — The consistency check for the component 'ComponentName'\'LogicalPath' has failed.
Description
The consistency check for the component ''\'' has failed. The application '' will not be available in the backup created at ''. Review the event details for information about consistency check issues.
Message #
Fields #
| Name | Description |
|---|---|
ComponentName UnicodeString | — |
LogicalPath UnicodeString | — |
ApplicationId UnicodeString | — |
BackupTime FILETIME | — |
WriterId GUID | — |
ErrorCode UInt32 | — |
Event ID 608 — A scheduled backup has been configured to create a backup of 'BackupTargetList' daily at 'BackupTime'.
Event ID 609 — The scheduled backup has been modified to create a backup of 'BackupTargetList' daily at 'BackupTime'.
Event ID 610 — The scheduled backup was canceled.
Description
The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.
Message #
Event ID 611 — A scheduled backup has been configured for this computer.
Description
A scheduled backup has been configured for this computer.
Message #
Event ID 612 — The scheduled backup was canceled.
Description
The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.
Message #
Event ID 656 — A new volume was detected that is not in the list of volumes to include in the backup.
Description
A new volume was detected that is not in the list of volumes to include in the backup. Please add it to the scheduled backup configuration if you want to protect this volume.
Message #
Event ID 658 — A volume 'BackupTargetFriendlyName' in the list of volumes to include in the backup is missing.
Event ID 704 — The operation to recover 'RestoreTargetNameList' was attempted at 'RestoreTime'.
Event ID 706 — The operation to recover 'RestoreTargetNameList' has successfully completed at 'RestoreTime'.
Event ID 707 — The operation to recover 'RestoreTargetNameList' has completed with errors at 'RestoreTime'.
Description
The operation to recover '' has completed with errors at ''. Error reported ''(). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTargetNameList UnicodeString | — |
RestoreTime FILETIME | — |
ErrorCode HexInt32 | — |
ErrorMessage UnicodeString | — |
Event ID 708 — The operation to recover 'RestoreTargetNameList' has failed with errors at 'RestoreTime'.
Description
The operation to recover 'RestoreTargetNameList' has failed with errors at 'RestoreTime'. Error reported 'ErrorCode'(ErrorMessage). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTargetNameList UnicodeString | — |
RestoreTime FILETIME | — |
ErrorCode HexInt32 | — |
ErrorMessage UnicodeString | — |
Event ID 709 — The operation to recover 'RestoreTargetNameList' was canceled at 'RestoreTime'.
Event ID 710 — The operation to recover volume 'RestoreTargetNameList' has failed or was canceled at 'RestoreTime'.
Description
The operation to recover volume 'RestoreTargetNameList' has failed or was canceled at 'RestoreTime'. The volume may now be corrupted and may need to be reformatted. Run CHKDSK /R on the volume to look for corrupted sectors.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTargetNameList UnicodeString | — |
RestoreTime FILETIME | — |
Event ID 711 — The operation to recover 'RestoreTargetNameList' has failed at 'RestoreTime' because the volume that you are recovering to is too small.
Event ID 721 — The operation to recover 'RestoreTargetNameList' has completed successfully at 'RestoreTime'.
Event ID 722 — The operation to recover 'RestoreTargetNameList' has completed with errors at 'RestoreTime'.
Description
The operation to recover 'RestoreTargetNameList' has completed with errors at 'RestoreTime'. Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTargetNameList UnicodeString | — |
RestoreTime FILETIME | — |
ErrorCode HexInt32 | — |
ErrorMessage UnicodeString | — |
Event ID 723 — The operation to recover 'RestoreTargetNameList' has failed with errors at 'RestoreTime'.
Description
The operation to recover 'RestoreTargetNameList' has failed with errors at 'RestoreTime'. Error reported 'ErrorCode'(ErrorMessage). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.
Message #
Fields #
| Name | Description |
|---|---|
RestoreTargetNameList UnicodeString | — |
RestoreTime FILETIME | — |
ErrorCode HexInt32 | — |
ErrorMessage UnicodeString | — |
Event ID 724 — The operation to recover 'RestoreTargetNameList' was canceled at 'RestoreTime'.
Event ID 737 — The operation to recover component(s) 'RestoreTargetNameList' has completed successfully at 'RestoreTime'.
Event ID 738 — The operation to recover component(s) 'RestoreTargetNameList' has completed with errors at 'RestoreTime'.
Event ID 739 — The operation to recover component(s) 'RestoreTargetNameList' has failed with errors at 'RestoreTime'.
Event ID 740 — The operation to recover component(s) 'RestoreTargetNameList' was canceled at 'RestoreTime'.
Event ID 753 — The Block Level Backup Engine service has successfully started.
Description
The Block Level Backup Engine service has successfully started.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Backup",
"guid": "1DB28F2E-8F80-4027-8C5A-A11F7F10F62D",
"event_source_name": "",
"event_id": 753,
"version": 0,
"level": 4,
"task": 0,
"opcode": 1,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T20:45:13.856958+00:00",
"event_record_id": 3732,
"correlation": {},
"execution": {
"process_id": 10020,
"thread_id": 2748
},
"channel": "Application",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 754 — The Block Level Backup Engine service has stopped.
Description
The Block Level Backup Engine service has stopped.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Backup",
"guid": "1DB28F2E-8F80-4027-8C5A-A11F7F10F62D",
"event_source_name": "",
"event_id": 754,
"version": 0,
"level": 4,
"task": 0,
"opcode": 2,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T20:55:13.877483+00:00",
"event_record_id": 3745,
"correlation": {},
"execution": {
"process_id": 10020,
"thread_id": 2748
},
"channel": "Application",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 755 — Installing the handler for the Block Level Backup Engine service has failed with error code 'HandleInstallErrorCode'.
Event ID 756 — The Block Level Backup Engine service received an unknown request with code 'UnknownRequestCode'.
Event ID 769 — The system state recovery operation started at 'RestoreTime'.
Event ID 770 — The system state recovery operation has completed.
Event ID 771 — The system state recovery operation that started at 'RestoreTime' has completed successfully.
Event ID 772 — The system state recovery operation that started at 'RestoreTime' was canceled.
Event ID 773 — The system state recovery operation that started at 'RestoreTime' has completed with errors.
Event ID 774 — The system state recovery operation that started at 'RestoreTime' has failed with errors.
Event ID 1025 — The operation to recover Hyper-V component(s) has completed.
Description
The operation to recover Hyper-V component(s) has completed.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 1026 — The operation to recover Hyper-V component(s) that started at 'RestoreTime' has completed successfully.
Description
The operation to recover Hyper-V component(s) that started at 'RestoreTime' has completed successfully.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 1027 — The operation to recover Hyper-V component(s) has completed with errors.
Description
The operation to recover Hyper-V component(s) has completed with errors. One or more components may not have been recovered correctly.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 1028 — The operation to recover Hyper-V component(s) has failed with errors.
Description
The operation to recover Hyper-V component(s) has failed with errors.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 1029 — The operation to recover Hyper-V component(s) that started at 'RestoreTime' was canceled.
Description
The operation to recover Hyper-V component(s) that started at 'RestoreTime' was canceled.
Message #
Fields #
| Name | Description |
|---|---|
BackupSetId GUID | — |
BackupSetTime FILETIME | — |
RestoreEventId GUID | — |
RecoveryFromSSB Boolean | — |
BackupTargetPath UnicodeString | — |
AppRestoreAlternateTargetPath UnicodeString | — |
RestoreState Int32 | — |
HRESULT HexInt32 | — |
DetailedHRESULT HexInt32 | — |
RestoreTime FILETIME | — |
NumOfComponents UInt32 | — |
FileSuccessLogPath UnicodeString | — |
FileFailureLogPath UnicodeString | — |
AppsInfo UnicodeString | — |
AlternateLocationRecovery Boolean | — |
RecreatePath Boolean | — |
ComponentInfoSummary UnicodeString | — |
Event ID 1040 — The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has completed successfully at 'RestoreTime'.
Event ID 1041 — The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has completed with errors at 'RestoreTime'.
Event ID 1042 — The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has failed with errors at 'RestoreTime'.
Event ID 1043 — The operation to recover Hyper-V component(s) 'RestoreTargetNameList' was canceled at 'RestoreTime'.
Event ID 1044 — New Online backup provider registered.
Event ID 1045 — Online backup provider deregistered.
Description
Online backup provider deregistered.
Message #
Event ID 1281 — Online backup has reported a status change.
Event ID 1282 — New Online backup provider registered.
Event ID 1283 — Online backup provider deregistered.
Description
Online backup provider deregistered.