detection.wiki

Microsoft-Windows-CloudStore

60 events across 3 channels

Event IDTitleChannel
1Error ErrorCode occurred.Operational
2Error ErrorCode occurred.Operational
1000Discovered schema provider SchemaProvider.Debug
1001Successfully loaded ProviderCount schemas.Debug
2001Ignoring ommitted field FieldId with unknown type BondDataType.Operational
2003Conflict resolution of type {QualifiedTypeName} started.Operational
2004Conflict resolution of type QualifiedTypeName complete.Debug
2005Conflict resolution of type {QualifiedTypeName} complete.Operational
2006Conflict resolution of type {CorrelationVector} complete.Debug
2007Resolved a set containing duplicated values.Operational
2008The 'original' version (OriginalVersion) of type QualifiedTypeName is more …Operational
2009The data of type QualifiedTypeName was corrupted and ignored.Operational
2010The data of type QualifiedTypeName was corrupted and ignored.Operational
2011The data of type QualifiedTypeName was corrupted and ignored.Operational
2012The data of type QualifiedTypeName was corrupted and ignored.Operational
2013The data of type QualifiedTypeName was corrupted and ignored.Operational
2014The data of type QualifiedTypeName was corrupted and ignored.Operational
2015The AppExtension of name AppExtensionName having type TypeName failed with error …Operational
2016The AppExtension of name AppExtensionName having type TypeName failed with error …Operational
2017Found an list item instance with a missing index value while merging vector as a …Operational
2018Conflict resolution policy of VectorAsMap requires an index field to be defined …Operational
2019Conflict resolution policy of VectorAsMap requires index fields to be an integer …Operational
2020Conflict resolution policy of VectorAsMap the list items to be a structure.Operational
3002Sucessfully deleted Version.Debug
3003Saving Id and merging with 'theirs' data.Debug
3004Saving Id without 'theirs' data.Debug
3005Overwriting Id with 'yours' data to repair inaccessible store (access failed …Operational
3006Uploading Id failed with error code ErrorCode.Operational
3007Successfully loaded CorrelationVector.Debug
3008Successfully saved CorrelationVector.Debug
3010Successfully saved cloud data for {Id}.Debug
3012Successfully saved merged cloud data for {Id}.Debug
3013Downloading Id failed with error code ErrorCode.Operational
3014Delete of Id was ignored because the data changed after it was deleted.Debug
3015The attempt to load CorrelationVector failed because the data was corrupt.Operational
3016The value {Id} was garbage collected from the local cache because it was not …Operational
3017The object ObjectName has an unexpected security descriptor.Debug
3018The cache invalidator has started.Debug
3019The cache invalidator has stopped.Debug
3020The cache invalidator is processing ActivitiesCount activities.Debug
3021The Backup master policy is set.Operational
3022Backup policy name Id set failed with error code ErrorCode.Operational
3023The transport layer reported a failure: Id with error code ErrorCode.Operational
3032Error TranslatedErrorCode occurred trying to perform file copy operation for …Operational
3033Error TranslatedErrorCode occurred trying to retrive the device profile during …Operational
4000Attempting to save device profile BackupProfileId.Initialization
4001Error saving internal type TypeName: StatusCode.Initialization
4002Successfully setup Cloud Store backup/restore partition information.Initialization
4003Failed to setup Cloud Store backup/restore partition information at stage Stage …Initialization
4004Timed out after mirroring UpdateCount settings sync policies in Elapsed …Initialization
4005Completed mirroring UpdateCount settings sync policies in Elapsed milliseconds.Initialization
4006Set policy Target to Enabled.Initialization
4007Failed to set policy Target to Enabled: ErrorCode.Initialization
4008Restore data successfully copied from restore partition RestorePartitionId to …Initialization
4009Failed to copy restore data successfully copied from restore partition …Initialization
4010Copied single restore partition data item from Path to backup partition as Id.Initialization
4011Skipped copying single restore partition at Path to backup partition as Id as it …Initialization
4012Error processing type TypeName.Initialization
10000Operational
10001Debug

Event ID 1 — Error ErrorCode occurred.

#
Provider
Microsoft-Windows-CloudStore
Channel
Operational
Level
Error

Description

Error ErrorCode occurred. See event details for more information.

Message #

Error %3 occurred. See event details for more information.

Fields #

NameDescription
ProcessName UnicodeString—
Type UInt32—
ErrorCode UInt32—
File AnsiString—
LineNumber UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T16:58:26.480434+00:00",
    "event_record_id": 54,
    "correlation": {},
    "execution": {
      "process_id": 4128,
      "thread_id": 4196
    },
    "channel": "Microsoft-Windows-CloudStore/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "ProcessName": "explorer.exe",
    "Type": 2,
    "ErrorCode": 2147746053,
    "File": "onecoreuap\\shell\\cloudstore\\store\\cache\\src\\cloudcacheinvalidatorsso.cpp",
    "LineNumber": 504
  },
  "message": ""
}

References #

Event ID 2 — Error ErrorCode occurred.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Error ErrorCode occurred. See event details for more information.

Message #

Error %3 occurred. See event details for more information.

Fields #

NameDescription
ProcessName UnicodeString—
Type UInt32—
ErrorCode UInt32—
File AnsiString—
LineNumber UInt32—
Context UnicodeString—

Event ID 1000 — Discovered schema provider SchemaProvider.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

Discovered schema provider SchemaProvider.

Message #

Discovered schema provider %1.

Fields #

NameDescription
SchemaProvider GUID—

Event ID 1001 — Successfully loaded ProviderCount schemas.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

Successfully loaded ProviderCount schemas.

Message #

Successfully loaded %1 schemas.

Fields #

NameDescription
ProviderCount UInt32—

Event ID 2001 — Ignoring ommitted field FieldId with unknown type BondDataType.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Ignoring ommitted field FieldId with unknown type BondDataType.

Message #

Ignoring ommitted field %1 with unknown type %2.

Fields #

NameDescription
FieldId UInt16—
BondDataType UInt32—

Event ID 2003 — Conflict resolution of type {QualifiedTypeName} started.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Message #

Conflict resolution of type {QualifiedTypeName} started. 'Yours' data is version {YoursVersion} with size {YoursSize}. See event details for more information. Extended information may be available in the Debug log.

Fields #

NameDescription
QualifiedTypeName—
YoursVersion—
YoursSize—

Event ID 2004 — Conflict resolution of type QualifiedTypeName complete.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

Conflict resolution of type QualifiedTypeName complete. See event details for more information.

Message #

Conflict resolution of type %2 complete. See event details for more information.

Fields #

NameDescription
CorrelationVector AnsiString—
QualifiedTypeName AnsiString—
SchemaSize UInt32—
Schema Binary—
ForceLastWriterWins Boolean—
OriginalVersion UInt64—
OriginalTombstoned Boolean—
OriginalSize UInt32—
OriginalData Binary—
TheirsVersion UInt64—
TheirsTombstoned Boolean—
TheirsSize UInt32—
TheirsData Binary—
YoursVersion UInt64—
YoursTombstoned Boolean—
YoursSize UInt32—
YoursData Binary—
ResolvedVersion UInt64—
ResolvedTombstoned Boolean—
ResolvedSize UInt32—
ResolvedData Binary—

Event ID 2005 — Conflict resolution of type {QualifiedTypeName} complete.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Conflict resolution of type {QualifiedTypeName} complete. Result is version {Version} with size {Size}. See event details for more information. Extended information may be available in the Debug log.

Message #

Conflict resolution of type {QualifiedTypeName} complete. Result is version {Version} with size {Size}. See event details for more information. Extended information may be available in the Debug log.

Fields #

NameDescription
QualifiedTypeName—
Version—
Size—

Event ID 2006 — Conflict resolution of type {CorrelationVector} complete.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

Conflict resolution of type {CorrelationVector} complete. See event details for more information.

Message #

Conflict resolution of type {CorrelationVector} complete. See event details for more information.

Fields #

NameDescription
CorrelationVector—

Event ID 2007 — Resolved a set containing duplicated values.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Resolved a set containing duplicated values. The duplicate values were ignored. See event details for more information.

Message #

Resolved a set containing duplicated values. The duplicate values were ignored. See event details for more information.

Fields #

NameDescription
Index UInt64—

Event ID 2008 — The 'original' version (OriginalVersion) of type QualifiedTypeName is more recent than the 'theirs' version (TheirsVersion) or the 'yours' version (YoursVersion).

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The 'original' version () of type is more recent than the 'theirs' version () or the 'yours' version (). Healing the store by using the most recent version (). See event details for more information.

Message #

The 'original' version (%2) of type %1 is more recent than the 'theirs' version (%3) or the 'yours' version (%4). Healing the store by using the most recent version (%5). See event details for more information.

Fields #

NameDescription
QualifiedTypeName AnsiString—
OriginalVersion UInt64—
TheirsVersion UInt64—
YoursVersion UInt64—
ResolvedVersion UInt64—

Event ID 2009 — The data of type QualifiedTypeName was corrupted and ignored.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

NameDescription
QualifiedTypeName AnsiString—
Base64String AnsiString—

Event ID 2010 — The data of type QualifiedTypeName was corrupted and ignored.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

NameDescription
QualifiedTypeName AnsiString—

Event ID 2011 — The data of type QualifiedTypeName was corrupted and ignored.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

NameDescription
QualifiedTypeName AnsiString—
Size UInt32—
Data Binary—

Event ID 2012 — The data of type QualifiedTypeName was corrupted and ignored.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

NameDescription
QualifiedTypeName AnsiString—

Event ID 2013 — The data of type QualifiedTypeName was corrupted and ignored.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

NameDescription
QualifiedTypeName AnsiString—
Base64String AnsiString—

Event ID 2014 — The data of type QualifiedTypeName was corrupted and ignored.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

NameDescription
QualifiedTypeName AnsiString—

Event ID 2015 — The AppExtension of name AppExtensionName having type TypeName failed with error code ErrorCode found.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The AppExtension of name AppExtensionName having type TypeName failed with error code ErrorCode found.

Message #

The AppExtension of name %1 having type %2 failed with error code %3 found.

Fields #

NameDescription
AppExtensionName UnicodeString—
TypeName UnicodeString—
ErrorCode UInt32—

Event ID 2016 — The AppExtension of name AppExtensionName having type TypeName failed with error code ErrorCode found.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The AppExtension of name AppExtensionName having type TypeName failed with error code ErrorCode found.

Message #

The AppExtension of name %1 having type %2 failed with error code %3 found.

Fields #

NameDescription
AppExtensionName UnicodeString—
TypeName UnicodeString—
ErrorCode UInt32—

Event ID 2017 — Found an list item instance with a missing index value while merging vector as a map.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Found an list item instance with a missing index value while merging vector as a map. The list item was ignored. See event details for more information.

Message #

Found an list item instance with a missing index value while merging vector as a map. The list item was ignored. See event details for more information.

Fields #

NameDescription
Index UInt64—

Event ID 2018 — Conflict resolution policy of VectorAsMap requires an index field to be defined on the list item structure.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Conflict resolution policy of VectorAsMap requires an index field to be defined on the list item structure. Using MergeAsSet instead. See event details for more information.

Message #

Conflict resolution policy of VectorAsMap requires an index field to be defined on the list item structure. Using MergeAsSet instead. See event details for more information.

Fields #

NameDescription
QualifiedTypeName AnsiString—

Event ID 2019 — Conflict resolution policy of VectorAsMap requires index fields to be an integer or string.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Conflict resolution policy of VectorAsMap requires index fields to be an integer or string. Using MergeAsSet instead. See event details for more information.

Message #

Conflict resolution policy of VectorAsMap requires index fields to be an integer or string. Using MergeAsSet instead. See event details for more information.

Fields #

NameDescription
QualifiedTypeName AnsiString—

Event ID 2020 — Conflict resolution policy of VectorAsMap the list items to be a structure.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Conflict resolution policy of VectorAsMap the list items to be a structure. Using MergeAsSet instead. See event details for more information.

Message #

Conflict resolution policy of VectorAsMap the list items to be a structure. Using MergeAsSet instead. See event details for more information.

Fields #

NameDescription
BondDataType UInt32—

Event ID 3002 — Sucessfully deleted Version.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

Sucessfully deleted Version. See event details for more information.

Message #

Sucessfully deleted %2. See event details for more information.

Fields #

NameDescription
Id AnsiString—
Version UInt64—

Event ID 3003 — Saving Id and merging with 'theirs' data.

Provider
Microsoft-Windows-CloudStore
Channel
Debug
Level
Informational

Description

Saving Id and merging with 'theirs' data. 'Theirs' data has size Size and is version Version.

Message #

Saving %1 and merging with 'theirs' data. 'Theirs' data has size %3 and is version %2.

Fields #

NameDescription
Id AnsiString—
Version UInt64—
Size UInt64—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T19:59:29.135294+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 2812,
      "thread_id": 6540
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Id": "$de${e5ec10ba-db50-407a-b646-c86d386f4af1}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap",
    "Version": 134179047067427004,
    "Size": 1261
  },
  "message": ""
}

Event ID 3004 — Saving Id without 'theirs' data.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

Saving Id without 'theirs' data.

Message #

Saving %1 without 'theirs' data.

Fields #

NameDescription
Id AnsiString—

Event ID 3005 — Overwriting Id with 'yours' data to repair inaccessible store (access failed with error code ErrorCode).

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Overwriting Id with 'yours' data to repair inaccessible store (access failed with error code ErrorCode).

Message #

Overwriting %1 with 'yours' data to repair inaccessible store (access failed with error code %2).

Fields #

NameDescription
Id AnsiString—
ErrorCode UInt32—

Event ID 3006 — Uploading Id failed with error code ErrorCode.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Uploading Id failed with error code ErrorCode. The data was sucessfully stored locally and will be uploaded later.

Message #

Uploading %1 failed with error code %2. The data was sucessfully stored locally and will be uploaded later.

Fields #

NameDescription
Id AnsiString—
ErrorCode UInt32—

Event ID 3007 — Successfully loaded CorrelationVector.

Provider
Microsoft-Windows-CloudStore
Channel
Debug
Level
Informational

Description

Successfully loaded CorrelationVector. See event details for more information.

Message #

Successfully loaded %2. See event details for more information.

Fields #

NameDescription
Data_0—
CorrelationVector AnsiString—
Id AnsiString—
Version UInt64—
Size UInt32—
Data Binary—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3007,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T19:59:29.134672+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 2812,
      "thread_id": 6540
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "434201000D10120104267B00450035004500430031003000420041002D0044004200350030002D0034003000370041002D0042003600340036002D004300380036004400330038003600460034004100460031007D0000",
    "CorrelationVector": "",
    "Id": "$$windows.data.platform.partitioning.activepartitions",
    "Version": 134151755085939223,
    "Size": 87
  },
  "message": ""
}

Event ID 3008 — Successfully saved CorrelationVector.

Provider
Microsoft-Windows-CloudStore
Channel
Debug
Level
Informational

Description

Successfully saved CorrelationVector. See event details for more information.

Message #

Successfully saved %2. See event details for more information.

Fields #

NameDescription
Data_0—
CorrelationVector AnsiString—
Id AnsiString—
Version UInt64—
Size UInt32—
Data Binary—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3008,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T19:59:29.136026+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 2812,
      "thread_id": 6540
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "434201000D120A0A1D50007E0043004C0041005500440045005F0050005A00530038005300580052004A00580046004A004A004300210043004C004100550044004500C70A5E97033DC51401C61E909780EBECE1ACEE01005550007E00570049004E0044004F00570053002E0049004D004D0045005200530049005600450043004F004E00540052004F004C00500041004E0045004C005F004300570035004E0031004800320054005800590045005700590021004D004900430052004F0053004F00460054002E00570049004E0044004F00570053002E0049004D004D0045005200530049005600450043004F004E00540052004F004C00500041004E0045004C00C70AC3780E3CC51401C61EF091F49ADCE3ACEE01001C57007E004D004900430052004F0053004F00460054002E00570049004E0044004F00570053002E004500580050004C004F00520045005200C70A92A59A3DC51409C61EA0B0DAA7F0E3ACEE01000857007E004D0053004500440047004500C70ADBFAA63CC51405C61E909EF2BBA2E2ACEE01003057007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0043004D0044002E00450058004500C70A669E913DC5140BC61EC0FDFDA59EE4ACEE01003457007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C004D0053005000410049004E0054002E00450058004500C70AF735CE3BC61E8A9F8FF1F3C9A6EE01003457007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C004E004F00540045005000410044002E00450058004500C70A5FC48F3CC51403C61ED090BFD4FCF8A6EE01003957007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0053004E0049005000500049004E00470054004F004F004C002E00450058004500C70A386F343DC61E8A9F8FF1F3C9A6EE01004E57007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C00570049004E0044004F005700530050004F005700450052005300480045004C004C005C00560031002E0030005C0050004F005700450052005300480045004C004C002E00450058004500C70A19F7053CC51402C61EE0BCD6F5ADE2ACEE01005257007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C00570049004E0044004F005700530050004F005700450052005300480045004C004C005C00560031002E0030005C0050004F005700450052005300480045004C004C005F004900530045002E00450058004500C70A37E32F3DC51403C61EE0BB82CF9EE2ACEE010000",
    "CorrelationVector": "",
    "Id": "$de${e5ec10ba-db50-407a-b646-c86d386f4af1}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap",
    "Version": 134179055691341358,
    "Size": 1261
  },
  "message": ""
}

Event ID 3010 — Successfully saved cloud data for {Id}.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

Successfully saved cloud data for {Id}. See event details for more information.

Message #

Successfully saved cloud data for {Id}. See event details for more information.

Fields #

NameDescription
Id—

Event ID 3012 — Successfully saved merged cloud data for {Id}.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

Successfully saved merged cloud data for {Id}. See event details for more information.

Message #

Successfully saved merged cloud data for {Id}. See event details for more information.

Fields #

NameDescription
Id—

Event ID 3013 — Downloading Id failed with error code ErrorCode.

#
Provider
Microsoft-Windows-CloudStore
Channel
Operational
Level
Warning

Description

Downloading Id failed with error code ErrorCode.

Message #

Downloading %1 failed with error code %2.

Fields #

NameDescription
Id AnsiString—
ErrorCode UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3013,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:48:34.113221+00:00",
    "event_record_id": 57,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0000-DAED-EDE43710DA01"
    },
    "execution": {
      "process_id": 16236,
      "thread_id": 22096
    },
    "channel": "Microsoft-Windows-CloudStore/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Id": "default$windows.data.settings.settingsusagehistory|windows.data.settings.settingsusagehistory",
    "ErrorCode": 2147746053
  },
  "message": ""
}

References #

Event ID 3014 — Delete of Id was ignored because the data changed after it was deleted.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

Delete of Id was ignored because the data changed after it was deleted. See event details for more information.

Message #

Delete of %1 was ignored because the data changed after it was deleted. See event details for more information.

Fields #

NameDescription
Id AnsiString—
TheirsVersion UInt64—
YoursVersion UInt64—

Event ID 3015 — The attempt to load CorrelationVector failed because the data was corrupt.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The attempt to load CorrelationVector failed because the data was corrupt. See event details for more information.

Message #

The attempt to load %1 failed because the data was corrupt. See event details for more information.

Fields #

NameDescription
CorrelationVector AnsiString—
Id AnsiString—
Version UInt64—
Size UInt32—
Data Binary—

Event ID 3016 — The value {Id} was garbage collected from the local cache because it was not reachable.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The value {Id} was garbage collected from the local cache because it was not reachable.

Message #

The value {Id} was garbage collected from the local cache because it was not reachable.

Fields #

NameDescription
Id—

Event ID 3017 — The object ObjectName has an unexpected security descriptor.

Provider
Microsoft-Windows-CloudStore
Channel
Debug
Level
Informational

Description

The object ObjectName has an unexpected security descriptor. Recovering by resetting the security descriptor. See event details for more information.

Message #

The object %1 has an unexpected security descriptor. Recovering by resetting the security descriptor. See event details for more information.

Fields #

NameDescription
ObjectName UnicodeString—
CurrentAcl UnicodeString—
ExpectedAcl UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3017,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T20:06:36.816855+00:00",
    "event_record_id": 25,
    "correlation": {},
    "execution": {
      "process_id": 1944,
      "thread_id": 8164
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236"
    }
  },
  "event_data": {
    "ObjectName": "CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudStore",
    "CurrentAcl": "D:(A;CI;KA;;;S-1-15-3-1024-3035980445-2343077072-2039973919-2593655016-2336600711-3402322490-2613491542-1611519126)(A;OICIID;KA;;;S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236)(A;OICIID;KA;;;SY)(A;OICIID;KA;;;BA)(A;OICIID;KR;;;RC)",
    "ExpectedAcl": "D:AI(A;CI;KA;;;S-1-15-3-1024-3035980445-2343077072-2039973919-2593655016-2336600711-3402322490-2613491542-1611519126)(A;OICIID;KA;;;S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236)(A;OICIID;KA;;;SY)(A;OICIID;KA;;;BA)(A;OICIID;KR;;;RC)"
  },
  "message": ""
}

Event ID 3018 — The cache invalidator has started.

Provider
Microsoft-Windows-CloudStore
Channel
Debug
Level
Informational

Description

The cache invalidator has started.

Message #

The cache invalidator has started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3018,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T20:07:56.365500+00:00",
    "event_record_id": 73,
    "correlation": {},
    "execution": {
      "process_id": 8768,
      "thread_id": 9872
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 3019 — The cache invalidator has stopped.

Provider
Microsoft-Windows-CloudStore
Channel
Debug
Level
Informational

Description

The cache invalidator has stopped.

Message #

The cache invalidator has stopped.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3019,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T20:04:05.525095+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 6852,
      "thread_id": 7628
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 3020 — The cache invalidator is processing ActivitiesCount activities.

Provider
Microsoft-Windows-CloudStore
Channel
Debug

Description

The cache invalidator is processing ActivitiesCount activities.

Message #

The cache invalidator is processing %2 activities.

Fields #

NameDescription
CorrelationVector AnsiString—
ActivitiesCount UInt16—

Event ID 3021 — The Backup master policy is set.

#
Provider
Microsoft-Windows-CloudStore
Channel
Operational
Level
Informational

Description

The Backup master policy is set.

Message #

The Backup master policy is set.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3021,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:29:02.865478+00:00",
    "event_record_id": 17,
    "correlation": {},
    "execution": {
      "process_id": 5784,
      "thread_id": 6016
    },
    "channel": "Microsoft-Windows-CloudStore/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Event ID 3022 — Backup policy name Id set failed with error code ErrorCode.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Backup policy name Id set failed with error code ErrorCode.

Message #

Backup policy name %1 set failed with error code %2.

Fields #

NameDescription
Id AnsiString—
ErrorCode UInt32—

Event ID 3023 — The transport layer reported a failure: Id with error code ErrorCode.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

The transport layer reported a failure: Id with error code ErrorCode.

Message #

The transport layer reported a failure: %1 with error code %2.

Fields #

NameDescription
Id AnsiString—
ErrorCode UInt32—

Event ID 3032 — Error TranslatedErrorCode occurred trying to perform file copy operation for schema Type.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Error TranslatedErrorCode occurred trying to perform file copy operation for schema Type. See event details for more information.

Message #

Error %2 occurred trying to perform file copy operation for schema %1. See event details for more information.

Fields #

NameDescription
Type AnsiString—
TranslatedErrorCode Int32—
Stage UInt32—
Path UnicodeString—

Event ID 3033 — Error TranslatedErrorCode occurred trying to retrive the device profile during an operation on a backup/restore schema.

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Description

Error TranslatedErrorCode occurred trying to retrive the device profile during an operation on a backup/restore schema. See event details for more information.

Message #

Error %1 occurred trying to retrive the device profile during an operation on a backup/restore schema. See event details for more information.

Fields #

NameDescription
TranslatedErrorCode Int32—
IsProfileUpdate Boolean—
ProfileCollection AnsiString—
ProfileInstance AnsiString—
SchemaCollection AnsiString—
Cv AnsiString—

Event ID 4000 — Attempting to save device profile BackupProfileId.

#
Provider
Microsoft-Windows-CloudStore
Channel
Initialization
Level
Informational

Description

Attempting to save device profile BackupProfileId. See event details for more information.

Message #

Attempting to save device profile %1. See event details for more information.

Fields #

NameDescription
BackupProfileId AnsiString—
ProcessName UnicodeString—
IsDelete Boolean—
Cv AnsiString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 4000,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-05T22:29:03.009433+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 5784,
      "thread_id": 6016
    },
    "channel": "Microsoft-Windows-CloudStore/Initialization",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "BackupProfileId": "{8dcb8207-c294-40da-82e0-ce8f415acdb8}",
    "ProcessName": "taskhostw.exe",
    "IsDelete": false,
    "Cv": "/FVp6ocjxkiUITaIBQcllQ.0.1.2"
  },
  "message": ""
}

References #

Event ID 4001 — Error saving internal type TypeName: StatusCode.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Error saving internal type TypeName: StatusCode. See event details for more information.

Message #

Error saving internal type %1: %2. See event details for more information.

Fields #

NameDescription
TypeName AnsiString—
StatusCode Int32—
Cv AnsiString—

Event ID 4002 — Successfully setup Cloud Store backup/restore partition information.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Successfully setup Cloud Store backup/restore partition information. See event details for more information.

Message #

Successfully setup Cloud Store backup/restore partition information. See event details for more information.

Fields #

NameDescription
BackupProfileId UnicodeString—
RestoreProfileId UnicodeString—
DeviceDisplayName UnicodeString—
Cv AnsiString—
TypeName AnsiString—

Event ID 4003 — Failed to setup Cloud Store backup/restore partition information at stage Stage with error StatusCode.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Failed to setup Cloud Store backup/restore partition information at stage Stage with error StatusCode. See event details for more information.

Message #

Failed to setup Cloud Store backup/restore partition information at stage %2 with error %1. See event details for more information.

Fields #

NameDescription
StatusCode Int32—
Stage Int32—
Cv AnsiString—
TypeName AnsiString—

Event ID 4004 — Timed out after mirroring UpdateCount settings sync policies in Elapsed milliseconds.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Timed out after mirroring UpdateCount settings sync policies in Elapsed milliseconds. See event details for more information.

Message #

Timed out after mirroring %2 settings sync policies in %1 milliseconds. See event details for more information.

Fields #

NameDescription
Elapsed UInt64—
UpdateCount UInt32—
LastSource UnicodeString—
LastTarget UnicodeString—

Event ID 4005 — Completed mirroring UpdateCount settings sync policies in Elapsed milliseconds.

#
Provider
Microsoft-Windows-CloudStore
Channel
Initialization
Level
Informational

Description

Completed mirroring UpdateCount settings sync policies in Elapsed milliseconds.

Message #

Completed mirroring %2 settings sync policies in %1 milliseconds.

Fields #

NameDescription
Elapsed UInt64—
UpdateCount UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 4005,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-05T22:29:03.084800+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 5784,
      "thread_id": 6016
    },
    "channel": "Microsoft-Windows-CloudStore/Initialization",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Elapsed": 62,
    "UpdateCount": 1
  },
  "message": ""
}

References #

Event ID 4006 — Set policy Target to Enabled.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Set policy Target to Enabled.

Message #

Set policy %1 to %2.

Fields #

NameDescription
Target UnicodeString—
Enabled Boolean—
Forced Boolean—

Event ID 4007 — Failed to set policy Target to Enabled: ErrorCode.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Failed to set policy Target to Enabled: ErrorCode.

Message #

Failed to set policy %1 to %2: %4.

Fields #

NameDescription
Target UnicodeString—
Enabled Boolean—
Forced Boolean—
ErrorCode Int32—

Event ID 4008 — Restore data successfully copied from restore partition RestorePartitionId to backup partition BackupPartitionId.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Restore data successfully copied from restore partition RestorePartitionId to backup partition BackupPartitionId.

Message #

Restore data successfully copied from restore partition %1 to backup partition %2

Fields #

NameDescription
RestorePartitionId UnicodeString—
BackupPartitionId UnicodeString—

Event ID 4009 — Failed to copy restore data successfully copied from restore partition RestorePartitionId to backup partition BackupPartitionId: ErrorCode.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Failed to copy restore data successfully copied from restore partition RestorePartitionId to backup partition BackupPartitionId: ErrorCode.

Message #

Failed to copy restore data successfully copied from restore partition %1 to backup partition %2: %3

Fields #

NameDescription
RestorePartitionId UnicodeString—
BackupPartitionId UnicodeString—
ErrorCode Int32—

Event ID 4010 — Copied single restore partition data item from Path to backup partition as Id.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Copied single restore partition data item from Path to backup partition as Id.

Message #

Copied single restore partition data item from %1 to backup partition as %2

Fields #

NameDescription
Path UnicodeString—
Id AnsiString—

Event ID 4011 — Skipped copying single restore partition at Path to backup partition as Id as it already exists.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Skipped copying single restore partition at Path to backup partition as Id as it already exists.

Message #

Skipped copying single restore partition at %1 to backup partition as %2 as it already exists

Fields #

NameDescription
Path UnicodeString—
Id AnsiString—

Event ID 4012 — Error processing type TypeName.

Provider
Microsoft-Windows-CloudStore
Channel
Initialization

Description

Error processing type TypeName.

Message #

Error processing type %1

Fields #

NameDescription
TypeName AnsiString—
ErrorCode Int32—
Stage Int32—

Event ID 10000 —

Provider
Microsoft-Windows-CloudStore
Channel
Operational

Event ID 10001 —

Provider
Microsoft-Windows-CloudStore
Channel
Debug