Microsoft-Windows-BrokerInfrastructure
33 events across 3 channels
Event ID 1 — An instance of a background task with entry point TaskEntryPoint and name TaskName has been created in session UserContextId and given an ID of InstanceId.
Description
An instance of a background task with entry point TaskEntryPoint and name TaskName has been created in session UserContextId and given an ID of InstanceId.
Message #
Fields #
| Name | Description |
|---|---|
EntryPointLength UInt16 | — |
TaskEntryPoint UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
UserContextId UInt64 | — |
InstanceId GUID | — |
ApplicationId UInt64 | — |
PsmActivationType UInt32 | — |
CriticalActivation Boolean | — |
TriggerEventId GUID | — |
TriggerEventType UInt32 | — |
Event ID 2 — An instance of the background task with entry point EntryPoint running for user UserSid in session UserContextId returned with error code Result.
Description
An instance of the background task with entry point EntryPoint running for user UserSid in session UserContextId returned with error code Result.
Message #
Fields #
| Name | Description |
|---|---|
WorkItemId GUID | — |
BrokerId GUID | — |
UserContextId UInt64 | — |
TaskExecuted Boolean | — |
Result UInt32 | — |
UserSid SID | — |
PackageFullName UnicodeString | — |
EntryPointLength UInt16 | — |
EntryPoint UnicodeString | — |
ApplicationId UInt64 | — |
CpuThrottleCount UInt16 | — |
NetThrottleCount UInt16 | — |
Flags UInt16 | — |
Event ID 3 — The background infrastructure service issued a proxy activation for the background task with ID WorkItemId.
Event ID 4 — Background task for package PackageFullName with entry point EntryPoint was suspended due to CPU resource management policy.
Event ID 5 — Background task for package PackageFullName with entry point EntryPoint was suspended due to Network resource management policy.
Event ID 6 — Background task for package PackageFullName with entry point EntryPoint did not complete in response to a cancel notification.
Description
Background task for package PackageFullName with entry point EntryPoint did not complete in response to a cancel notification.
Message #
Fields #
| Name | Description |
|---|---|
PackageFullName UnicodeString | — |
EntryPointLength UInt16 | — |
EntryPoint UnicodeString | — |
UserSid SID | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-BrokerInfrastructure",
"guid": "E6835967-E0D2-41FB-BCEC-58387404E25A",
"event_source_name": "",
"event_id": 6,
"version": 0,
"level": 4,
"task": 100,
"opcode": 102,
"keywords": 4611686018427387905,
"time_created": "2026-03-11T19:27:55.206435+00:00",
"event_record_id": 445,
"correlation": {},
"execution": {
"process_id": 1116,
"thread_id": 5084
},
"channel": "Microsoft-Windows-BackgroundTaskInfrastructure/Operational",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"PackageFullName": "MicrosoftWindows.Client.CBS_1000.22634.1000.0_x64__cw5n1h2txyewy",
"EntryPointLength": 38,
"EntryPoint": "IrisService.BackgroundTask.UpdateTimer",
"UserSid": "S-1-5-21-3407486967-1585450050-1838039599-1000"
},
"message": ""
}
Event ID 7 — A signal request for the trigger with ID EventId and type EventType has begun.
Event ID 8 — The signal request for the trigger with ID EventId and type EventType has completed.
Event ID 9 — The condition with ID EventId and type EventType is changing state from OldState to NewState.
Event ID 10 — The condition with ID EventId and type EventType has changed state from OldState to NewState.
Event ID 11 — The application package PackageFullName running for user UserAccountName in session UserContextId is changing state to PackageState.
Event ID 12 — The application package PackageFullName running for user UserAccountName in session UserContextId has changed to state PackageState.
Event ID 13 — A background task with entry point TaskEntryPoint and name TaskName has been latched because its condition of type ConditionType has value ConditionValue but value ConditionDesiredValue was desired.
Description
A background task with entry point TaskEntryPoint and name TaskName has been latched because its condition of type ConditionType has value ConditionValue but value ConditionDesiredValue was desired.
Message #
Fields #
| Name | Description |
|---|---|
EntryPointLength UInt16 | — |
TaskEntryPoint UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
ConditionType UInt32 | — |
ConditionValue UInt32 | — |
ConditionDesiredValue Boolean | — |
Event ID 14 — A background task with entry point TaskEntryPoint and name TaskName has been unlatched.
Event ID 15 — A background task with entry point TaskEntryPoint and name TaskName has been dropped.
Event ID 16 — An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because an instance of the task is already running.
Event ID 17 — An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because BufferingReason.
Event ID 18 — An activation of a background task with entry point TaskEntryPoint and name TaskName that was buffered because BufferingReason has been unbuffered.
Description
An activation of a background task with entry point TaskEntryPoint and name TaskName that was buffered because BufferingReason has been unbuffered.
Message #
Fields #
| Name | Description |
|---|---|
EntryPointLength UInt16 | — |
TaskEntryPoint UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
BufferingReason UInt32 | — |
Event ID 19 — An instance with ID InstanceId of a background task with entry point TaskEntryPoint and name TaskName has been canceled in session UserContextId.
Description
An instance with ID InstanceId of a background task with entry point TaskEntryPoint and name TaskName has been canceled in session UserContextId.
Message #
Fields #
| Name | Description |
|---|---|
EntryPointLength UInt16 | — |
TaskEntryPoint UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
InstanceId GUID | — |
UserContextId UInt64 | — |
Event ID 20 — A background task with entry point TaskEntryPoint and name TaskName has been unregistered because DeletionReason.
Event ID 21 — The background task with entry point TaskEntryPoint and name TaskName failed to activate with error code Result.
Description
The background task with entry point TaskEntryPoint and name TaskName failed to activate with error code Result.
Message #
Fields #
| Name | Description |
|---|---|
EntryPointLength UInt16 | — |
TaskEntryPoint UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
Result UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-BrokerInfrastructure",
"guid": "E6835967-E0D2-41FB-BCEC-58387404E25A",
"event_source_name": "",
"event_id": 21,
"version": 0,
"level": 4,
"task": 100,
"opcode": 113,
"keywords": 4611686018427387905,
"time_created": "2026-03-12T02:57:25.195310+00:00",
"event_record_id": 465,
"correlation": {},
"execution": {
"process_id": 1116,
"thread_id": 5364
},
"channel": "Microsoft-Windows-BackgroundTaskInfrastructure/Operational",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"EntryPointLength": 38,
"TaskEntryPoint": "{8cfc164f-4be5-4fdd-94e9-e2af73ed4a19}",
"NameLength": 28,
"TaskName": "DashboardBackgroundFeedsTask",
"Result": 2147746132
},
"message": ""
}
Event ID 22 —
Fields #
| Name | Description |
|---|---|
WorkItemId GUID | — |
ApplicationId UInt64 | — |
UserContextId UInt64 | — |
PsmActivationType UInt32 | — |
CpuThrottleCount UInt16 | — |
NetThrottleCount UInt16 | — |
PackageFullName UnicodeString | — |
Event ID 23 —
Fields #
| Name | Description |
|---|---|
WorkItemId GUID | — |
BrokerId GUID | — |
TriggerEventId GUID | — |
TriggerEventType UInt32 | — |
CriticalActivation Boolean | — |
EntryPointLength UInt16 | — |
EntryPoint UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
PackageFullName UnicodeString | — |
UserSid SID | — |
ConditionCount UInt16 | — |
ConditinalEvent Boolean | — |
Event ID 24 —
Fields #
| Name | Description |
|---|---|
UserContextId UInt64 | — |
StateFlags UInt32 | — |
ActiveTaskCount UInt32 | — |
LockScreen Boolean | — |
PackageFullName UnicodeString | — |
UserSid SID | — |
Event ID 25 — The application package PackageFullName was terminated due to inactivity.
Description
The application package PackageFullName was terminated due to inactivity. The following ActiveTaskCount background task(s) were running ActiveTasks.
Message #
Fields #
| Name | Description |
|---|---|
SessionId UInt32 | — |
StateFlags UInt32 | — |
ActiveTaskCount UInt32 | — |
LockScreen Boolean | — |
PackageFullName UnicodeString | — |
UserSid SID | — |
ActiveTasks UnicodeString | — |
Event ID 26 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
Iteration UInt32 | — |
ActivitySummary UInt32 | — |
ActivityFilter UInt32 | — |
HangDetected Boolean | — |
EventType UInt32 | — |
PackageFullName UnicodeString | — |
EntryPoint UnicodeString | — |
InstanceId GUID | — |
CycleTime UInt64 | — |
NetTokens UInt64 | — |
PolicyVersion UInt8 | — |
Event ID 27 — A background task with entry point TaskEntryPoint and name TaskName in package PackageFullName is being canceled because it has an inactive instance running in session UserContextId.
Description
A background task with entry point TaskEntryPoint and name TaskName in package PackageFullName is being canceled because it has an inactive instance running in session UserContextId.
Message #
Fields #
| Name | Description |
|---|---|
EntryPointLength UInt16 | — |
TaskEntryPoint UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
PackageFullName UnicodeString | — |
InstanceId GUID | — |
UserContextId UInt64 | — |
UserSid SID | — |
LockScreen Boolean | — |
Event ID 28 —
Fields #
| Name | Description |
|---|---|
SessionId UInt32 | — |
TransitionId UInt32 | — |
Transition UInt32 | — |
Event ID 100 —
Fields #
| Name | Description |
|---|---|
ElapsedTime UInt32 | — |
TaskThrottleCount UInt32 | — |
EventType UInt32 | — |
PackageFullName UnicodeString | — |
EntryPoint UnicodeString | — |
Event ID 101 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
ActivitySummary UInt32 | — |
EventTypeAndBitfield UInt32 | — |
PackageFullName UnicodeString | — |
EntryPoint UnicodeString | — |
Event ID 200 —
Fields #
| Name | Description |
|---|---|
ActivityType UInt32 | — |
PackageFullName UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
Event ID 201 —
Fields #
| Name | Description |
|---|---|
ActivityType UInt32 | — |
PackageFullName UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
Event ID 300 —
Fields #
| Name | Description |
|---|---|
WorkItemId GUID | — |
EntryPointLength UInt16 | — |
EntryPoint UnicodeString | — |
NameLength UInt16 | — |
TaskName UnicodeString | — |
PackageFullName UnicodeString | — |
UserSid SID | — |
TriggerEventType UInt32 | — |
ScenarioInstanceId UInt16 | — |
AlwaysAllowed Boolean | — |
VoipApp Boolean | — |