Microsoft-Windows-BrokerInfrastructure

33 events across 3 channels

Event IDTitleChannel
1An instance of a background task with entry point TaskEntryPoint and name …Diagnostic
2An instance of the background task with entry point EntryPoint running for user …Diagnostic
3The background infrastructure service issued a proxy activation for the …Diagnostic
4Background task for package PackageFullName with entry point EntryPoint was …Diagnostic
5Background task for package PackageFullName with entry point EntryPoint was …Diagnostic
6Background task for package PackageFullName with entry point EntryPoint did not …Operational
7A signal request for the trigger with ID EventId and type EventType has begun.Diagnostic
8The signal request for the trigger with ID EventId and type EventType has …Diagnostic
9The condition with ID EventId and type EventType is changing state from OldState …Diagnostic
10The condition with ID EventId and type EventType has changed state from OldState …Diagnostic
11The application package PackageFullName running for user UserAccountName in …Diagnostic
12The application package PackageFullName running for user UserAccountName in …Diagnostic
13A background task with entry point TaskEntryPoint and name TaskName has been …Diagnostic
14A background task with entry point TaskEntryPoint and name TaskName has been …Diagnostic
15A background task with entry point TaskEntryPoint and name TaskName has been …Diagnostic
16An activation of a background task with entry point TaskEntryPoint and name …Diagnostic
17An activation of a background task with entry point TaskEntryPoint and name …Diagnostic
18An activation of a background task with entry point TaskEntryPoint and name …Diagnostic
19An instance with ID InstanceId of a background task with entry point …Diagnostic
20A background task with entry point TaskEntryPoint and name TaskName has been …Diagnostic
21The background task with entry point TaskEntryPoint and name TaskName failed to …Operational
22Operational
23Operational
24Operational
25The application package PackageFullName was terminated due to inactivity.Diagnostic
26Operational
27A background task with entry point TaskEntryPoint and name TaskName in package …Diagnostic
28Diagnostic
100Operational
101Operational
200Operational
201Operational
300Operational

Event ID 1 — An instance of a background task with entry point TaskEntryPoint and name TaskName has been created in session UserContextId and given an ID of InstanceId.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
Start

Description

An instance of a background task with entry point TaskEntryPoint and name TaskName has been created in session UserContextId and given an ID of InstanceId.

Message #

An instance of a background task with entry point %2 and name %4 has been created in session %5 and given an ID of %6.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
UserContextId UInt64
InstanceId GUID
ApplicationId UInt64
PsmActivationType UInt32
CriticalActivation Boolean
TriggerEventId GUID
TriggerEventType UInt32

Event ID 2 — An instance of the background task with entry point EntryPoint running for user UserSid in session UserContextId returned with error code Result.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
Stop

Description

An instance of the background task with entry point EntryPoint running for user UserSid in session UserContextId returned with error code Result.

Message #

An instance of the background task with entry point %9 running for user %6 in session %3 returned with error code %5.

Fields #

NameDescription
WorkItemId GUID
BrokerId GUID
UserContextId UInt64
TaskExecuted Boolean
Result UInt32
UserSid SID
PackageFullName UnicodeString
EntryPointLength UInt16
EntryPoint UnicodeString
ApplicationId UInt64
CpuThrottleCount UInt16
NetThrottleCount UInt16
Flags UInt16

Event ID 3 — The background infrastructure service issued a proxy activation for the background task with ID WorkItemId.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTaskProxy

Description

The background infrastructure service issued a proxy activation for the background task with ID WorkItemId.

Message #

The background infrastructure service issued a proxy activation for the background task with ID %1.

Fields #

NameDescription
WorkItemId GUID
BrokerId GUID
StateName UInt64

Event ID 4 — Background task for package PackageFullName with entry point EntryPoint was suspended due to CPU resource management policy.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskThrottledCpu

Description

Background task for package PackageFullName with entry point EntryPoint was suspended due to CPU resource management policy.

Message #

Background task for package %1 with entry point %3 was suspended due to CPU resource management policy.

Fields #

NameDescription
PackageFullName UnicodeString
EntryPointLength UInt16
EntryPoint UnicodeString
UserSid SID

Event ID 5 — Background task for package PackageFullName with entry point EntryPoint was suspended due to Network resource management policy.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskThrottledNet

Description

Background task for package PackageFullName with entry point EntryPoint was suspended due to Network resource management policy.

Message #

Background task for package %1 with entry point %3 was suspended due to Network resource management policy.

Fields #

NameDescription
PackageFullName UnicodeString
EntryPointLength UInt16
EntryPoint UnicodeString
UserSid SID

Event ID 6 — Background task for package PackageFullName with entry point EntryPoint did not complete in response to a cancel notification.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Level
Informational
Task
BackgroundTask
Opcode
TaskForcedCompletion

Description

Background task for package PackageFullName with entry point EntryPoint did not complete in response to a cancel notification.

Message #

Background task for package %1 with entry point %3 did not complete in response to a cancel notification.

Fields #

NameDescription
PackageFullName UnicodeString
EntryPointLength UInt16
EntryPoint UnicodeString
UserSid SID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BrokerInfrastructure",
    "guid": "E6835967-E0D2-41FB-BCEC-58387404E25A",
    "event_source_name": "",
    "event_id": 6,
    "version": 0,
    "level": 4,
    "task": 100,
    "opcode": 102,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-11T19:27:55.206435+00:00",
    "event_record_id": 445,
    "correlation": {},
    "execution": {
      "process_id": 1116,
      "thread_id": 5084
    },
    "channel": "Microsoft-Windows-BackgroundTaskInfrastructure/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "MicrosoftWindows.Client.CBS_1000.22634.1000.0_x64__cw5n1h2txyewy",
    "EntryPointLength": 38,
    "EntryPoint": "IrisService.BackgroundTask.UpdateTimer",
    "UserSid": "S-1-5-21-3407486967-1585450050-1838039599-1000"
  },
  "message": ""
}

Event ID 7 — A signal request for the trigger with ID EventId and type EventType has begun.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
TriggerSignal
Opcode
Start

Description

A signal request for the trigger with ID EventId and type EventType has begun.

Message #

A signal request for the trigger with ID %1 and type %2 has begun.

Fields #

NameDescription
EventId GUID
EventType UInt32

Event ID 8 — The signal request for the trigger with ID EventId and type EventType has completed.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
TriggerSignal
Opcode
Stop

Description

The signal request for the trigger with ID EventId and type EventType has completed.

Message #

The signal request for the trigger with ID %1 and type %2 has completed.

Fields #

NameDescription
EventId GUID
EventType UInt32

Event ID 9 — The condition with ID EventId and type EventType is changing state from OldState to NewState.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
ConditionChange
Opcode
Start

Description

The condition with ID EventId and type EventType is changing state from OldState to NewState.

Message #

The condition with ID %1 and type %2 is changing state from %3 to %4.

Fields #

NameDescription
EventId GUID
EventType UInt32
OldState UInt32
NewState Boolean

Event ID 10 — The condition with ID EventId and type EventType has changed state from OldState to NewState.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
ConditionChange
Opcode
Stop

Description

The condition with ID EventId and type EventType has changed state from OldState to NewState.

Message #

The condition with ID %1 and type %2 has changed state from %3 to %4.

Fields #

NameDescription
EventId GUID
EventType UInt32
OldState UInt32
NewState Boolean

Event ID 11 — The application package PackageFullName running for user UserAccountName in session UserContextId is changing state to PackageState.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
PackageStateChange
Opcode
Start

Description

The application package PackageFullName running for user UserAccountName in session UserContextId is changing state to PackageState.

Message #

The application package %1 running for user %2 in session %3 is changing state to %4.

Fields #

NameDescription
PackageFullName UnicodeString
UserAccountName UnicodeString
UserContextId UInt64
PackageState UInt32

Event ID 12 — The application package PackageFullName running for user UserAccountName in session UserContextId has changed to state PackageState.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
PackageStateChange
Opcode
Stop

Description

The application package PackageFullName running for user UserAccountName in session UserContextId has changed to state PackageState.

Message #

The application package %1 running for user %2 in session %3 has changed to state %4.

Fields #

NameDescription
PackageFullName UnicodeString
UserAccountName UnicodeString
UserContextId UInt64
PackageState UInt32

Event ID 13 — A background task with entry point TaskEntryPoint and name TaskName has been latched because its condition of type ConditionType has value ConditionValue but value ConditionDesiredValue was desired.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskLatched

Description

A background task with entry point TaskEntryPoint and name TaskName has been latched because its condition of type ConditionType has value ConditionValue but value ConditionDesiredValue was desired.

Message #

A background task with entry point %2 and name %4 has been latched because its condition of type %5 has value %6 but value %7 was desired.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
ConditionType UInt32
ConditionValue UInt32
ConditionDesiredValue Boolean

Event ID 14 — A background task with entry point TaskEntryPoint and name TaskName has been unlatched.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskUnlatched

Description

A background task with entry point TaskEntryPoint and name TaskName has been unlatched.

Message #

A background task with entry point %2 and name %4 has been unlatched.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString

Event ID 15 — A background task with entry point TaskEntryPoint and name TaskName has been dropped.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskDropped

Description

A background task with entry point TaskEntryPoint and name TaskName has been dropped.

Message #

A background task with entry point %2 and name %4 has been dropped.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString

Event ID 16 — An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because an instance of the task is already running.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskBufferedPolicy

Description

An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because an instance of the task is already running.

Message #

An activation of a background task with entry point %2 and name %4 has been buffered because an instance of the task is already running.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString

Event ID 17 — An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because BufferingReason.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskBufferedPackageState

Description

An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because BufferingReason.

Message #

An activation of a background task with entry point %2 and name %4 has been buffered because %5.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
BufferingReason UInt32

Event ID 18 — An activation of a background task with entry point TaskEntryPoint and name TaskName that was buffered because BufferingReason has been unbuffered.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskUnbuffered

Description

An activation of a background task with entry point TaskEntryPoint and name TaskName that was buffered because BufferingReason has been unbuffered.

Message #

An activation of a background task with entry point %2 and name %4 that was buffered because %5 has been unbuffered.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
BufferingReason UInt32

Event ID 19 — An instance with ID InstanceId of a background task with entry point TaskEntryPoint and name TaskName has been canceled in session UserContextId.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskCanceled

Description

An instance with ID InstanceId of a background task with entry point TaskEntryPoint and name TaskName has been canceled in session UserContextId.

Message #

An instance with ID %5 of a background task with entry point %2 and name %4 has been canceled in session %6.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
InstanceId GUID
UserContextId UInt64

Event ID 20 — A background task with entry point TaskEntryPoint and name TaskName has been unregistered because DeletionReason.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskUnregistered

Description

A background task with entry point TaskEntryPoint and name TaskName has been unregistered because DeletionReason.

Message #

A background task with entry point %2 and name %4 has been unregistered because %5.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
DeletionReason UInt32

Event ID 21 — The background task with entry point TaskEntryPoint and name TaskName failed to activate with error code Result.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Level
Informational
Task
BackgroundTask
Opcode
TaskActivationFailed

Description

The background task with entry point TaskEntryPoint and name TaskName failed to activate with error code Result.

Message #

The background task with entry point %2 and name %4 failed to activate with error code %5.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
Result UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BrokerInfrastructure",
    "guid": "E6835967-E0D2-41FB-BCEC-58387404E25A",
    "event_source_name": "",
    "event_id": 21,
    "version": 0,
    "level": 4,
    "task": 100,
    "opcode": 113,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-12T02:57:25.195310+00:00",
    "event_record_id": 465,
    "correlation": {},
    "execution": {
      "process_id": 1116,
      "thread_id": 5364
    },
    "channel": "Microsoft-Windows-BackgroundTaskInfrastructure/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "EntryPointLength": 38,
    "TaskEntryPoint": "{8cfc164f-4be5-4fdd-94e9-e2af73ed4a19}",
    "NameLength": 28,
    "TaskName": "DashboardBackgroundFeedsTask",
    "Result": 2147746132
  },
  "message": ""
}

Event ID 22 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Task
BackgroundTaskInstance
Opcode
DC_Stop

Fields #

NameDescription
WorkItemId GUID
ApplicationId UInt64
UserContextId UInt64
PsmActivationType UInt32
CpuThrottleCount UInt16
NetThrottleCount UInt16
PackageFullName UnicodeString

Event ID 23 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Task
BackgroundTask
Opcode
DC_Stop

Fields #

NameDescription
WorkItemId GUID
BrokerId GUID
TriggerEventId GUID
TriggerEventType UInt32
CriticalActivation Boolean
EntryPointLength UInt16
EntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
PackageFullName UnicodeString
UserSid SID
ConditionCount UInt16
ConditinalEvent Boolean

Event ID 24 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Task
Package
Opcode
DC_Stop

Fields #

NameDescription
UserContextId UInt64
StateFlags UInt32
ActiveTaskCount UInt32
LockScreen Boolean
PackageFullName UnicodeString
UserSid SID

Event ID 25 — The application package PackageFullName was terminated due to inactivity.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
Package
Opcode
PackageWatchdog

Description

The application package PackageFullName was terminated due to inactivity. The following ActiveTaskCount background task(s) were running ActiveTasks.

Message #

The application package %5 was terminated due to inactivity. The following %3 background task(s) were running %7.

Fields #

NameDescription
SessionId UInt32
StateFlags UInt32
ActiveTaskCount UInt32
LockScreen Boolean
PackageFullName UnicodeString
UserSid SID
ActiveTasks UnicodeString

Event ID 26 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Task
WatchdogIteration
Opcode
WatchdogIteration

Fields #

NameDescription
Duration UInt32
Iteration UInt32
ActivitySummary UInt32
ActivityFilter UInt32
HangDetected Boolean
EventType UInt32
PackageFullName UnicodeString
EntryPoint UnicodeString
InstanceId GUID
CycleTime UInt64
NetTokens UInt64
PolicyVersion UInt8

Event ID 27 — A background task with entry point TaskEntryPoint and name TaskName in package PackageFullName is being canceled because it has an inactive instance running in session UserContextId.

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
BackgroundTask
Opcode
TaskWatchdog

Description

A background task with entry point TaskEntryPoint and name TaskName in package PackageFullName is being canceled because it has an inactive instance running in session UserContextId.

Message #

A background task with entry point %2 and name %4 in package %5 is being canceled because it has an inactive instance running in session %7.

Fields #

NameDescription
EntryPointLength UInt16
TaskEntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
PackageFullName UnicodeString
InstanceId GUID
UserContextId UInt64
UserSid SID
LockScreen Boolean

Event ID 28 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Diagnostic
Task
SessionStateTransition
Opcode
SessionStateTransition

Fields #

NameDescription
SessionId UInt32
TransitionId UInt32
Transition UInt32

Event ID 100 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Task
BackgroundTaskPerfTrack
Opcode
Stop

Fields #

NameDescription
ElapsedTime UInt32
TaskThrottleCount UInt32
EventType UInt32
PackageFullName UnicodeString
EntryPoint UnicodeString

Event ID 101 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Task
WatchdogIterationPerfTrack
Opcode
WatchdogIteration

Fields #

NameDescription
Duration UInt32
ActivitySummary UInt32
EventTypeAndBitfield UInt32
PackageFullName UnicodeString
EntryPoint UnicodeString

Event ID 200 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Task
PdcReference
Opcode
Acquire

Fields #

NameDescription
ActivityType UInt32
PackageFullName UnicodeString
NameLength UInt16
TaskName UnicodeString

Event ID 201 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Task
PdcReference
Opcode
Release

Fields #

NameDescription
ActivityType UInt32
PackageFullName UnicodeString
NameLength UInt16
TaskName UnicodeString

Event ID 300 —

Provider
Microsoft-Windows-BrokerInfrastructure
Channel
Operational
Task
WorkItemBlockingDisconnectedStandby
Opcode
WorkItemBlockingDisconnectedStandby

Fields #

NameDescription
WorkItemId GUID
EntryPointLength UInt16
EntryPoint UnicodeString
NameLength UInt16
TaskName UnicodeString
PackageFullName UnicodeString
UserSid SID
TriggerEventType UInt32
ScenarioInstanceId UInt16
AlwaysAllowed Boolean
VoipApp Boolean