Microsoft-Windows-DeviceManagement-Pushrouter

107 events across 1 channel

Event IDTitleChannel
100MDM PushRouter Service: Failed to create ConfigManager lock service binding.Operational
101MDM PushRouter Service: Successfully created RPC Server Interface group.Operational
102MDM PushRouter Service: Failed to create RPC Server Interface group.Operational
103MDM PushRouter Service: Failed to activate RPC Server Interface group because a …Operational
104MDM PushRouter Service: Successfully activated RPC Server Interface group.Operational
105MDM PushRouter Service: Failed to activate RPC Server Interface group.Operational
106MDM PushRouter Service: Successfully deactivated RPC Server Interface group.Operational
107MDM PushRouter Service: Failed to deactivate RPC Server Interface group.Operational
108MDM PushRouter Service: Successfully closed RPC Server Interface group.Operational
109MDM PushRouter Service: Failed to close RPC Server Interface group.Operational
110MDM PushRouter Service: PushRouter RPC interface Idle status changed.Operational
111MDM PushRouter Service: Number of PushRouter clients remaining: (HRESULT).Operational
112MDM PushRouter Service: All clients handled.Operational
113MDM PushRouter Service: Number of active client count rolled over.Operational
114MDM PushRouter Service: PushRouter RPC run down occured.Operational
115MDM PushRouter Service: PushRouter::Open called by a client needing a handle to …Operational
116MDM PushRouter Service: PushRouter::Open called by a client needing to interact …Operational
117MDM PushRouter Service: PushRouter::Open called by a client needing to interact …Operational
118MDM PushRouter Service: PushRouter was submitted a message from the same service …Operational
119MDM PushRouter Service: PushRouter was submitted a message from the same service …Operational
120MDM PushRouter Service: PushRouter was submitted a message from the same service …Operational
121MDM PushRouter Service: PushRouter was submitted a message by a RPC client.Operational
122MDM PushRouter Service: PushRouter was submitted a message by a RPC client.Operational
123MDM PushRouter Service: PushRouter was created successfully.Operational
124MDM PushRouter Service: PushRouter could not be created successfully.Operational
125MDM PushRouter Service: Opening Service Control Manager to change PushRouter …Operational
126MDM PushRouter Service: Opening service handle to change PushRouter startup type …Operational
127MDM PushRouter Service: Changing PushRouter start up type to auto start failed.Operational
128MDM PushRouter Service: Changing PushRouter start up type to delayed auto start …Operational
129MDM PushRouter Service: PushRouter close called by a client interacting with it …Operational
130MDM PushRouter Service: PushRouter close called by a client interacting with it …Operational
131MDM PushRouter Service: A client initiated a get message operation from …Operational
132MDM PushRouter Service: A client was able to successfully get a message from …Operational
133MDM PushRouter Service: A client failed to get a message from PushRouter.Operational
134MDM PushRouter Service: PushRouter was instantiated.Operational
135MDM Message Persistence: Persisted message found.Operational
136MDM Message Persistence: Failed to load persisted message file.Operational
137MDM Message Persistence: Queue Id found for persisted message.Operational
138MDM Message Persistence: No client found for queue Id for persisted message.Operational
139MDM Message Persistence: Client found for queue Id for persisted message.Operational
140MDM Message Persistence: Client failed to launch for queue Id for persisted …Operational
141MDM Message Persistence: No persisted message found.Operational
142MDM Message Persistence: Failed to delete messages file.Operational
143MDM Message Persistence: Failed to process persisted messages.Operational
144MDM Message Persistence: Successfully processed persisted messages.Operational
145MDM PushRouter Service: PushRouter started routing a message.Operational
146MDM PushRouter Service: Routing a message failed.Operational
147MDM PushRouter Service: Message routed successfully.Operational
148MDM PushRouter Service: PushRouter started routing a new message.Operational
149MDM PushRouter Service: Failed to route a new message.Operational
150MDM PushRouter Service: Successfully routed a new message.Operational
151MDM Message Persistence: Failed to load unauthenticated messages file.Operational
152MDM PushRouter Authentication: Loaded an authentication provider.Operational
153MDM PushRouter Authentication: Getting authentication provider failed.Operational
154MDM PushRouter Authentication: Loaded authentication provider failed to …Operational
155MDM PushRouter Authentication: Message authenticated successfully.Operational
156MDM PushRouter Authentication: Message could not be authenticated.Operational
157MDM PushRouter Proxy: RPC call to get a message from PushRouter failed.Operational
158MDM PushRouter Proxy: RPC call to get a message from PushRouter succeeded.Operational
159MDM PushRouter Proxy: RPC call to submit a message from PushRouter failed.Operational
160MDM PushRouter Proxy: RPC call to submit a message from PushRouter succeeded.Operational
161MDM PushRouter Authentication: Failed to get network shared secret because ICCID …Operational
162MDM PushRouter Authentication: WAP Verification succeeded.Operational
163MDM PushRouter Authentication: WAP Verification failed.Operational
164MDM PushRouter Authentication: WAP Authentication failed.Operational
165MDM PushRouter Authentication: WAP Authentication succeeded.Operational
166MDM PushRouter Authentication: SyncMl Authentication failed.Operational
167MDM PushRouter Authentication: SyncMl Authentication succeeded.Operational
168MDM PushRouter Authentication: Getting ServerID from the trigger failed.Operational
169MDM PushRouter Authentication: Getting ServerID from the trigger succeeded.Operational
170MDM PushRouter Authentication: Validating trigger failed.Operational
171MDM PushRouter Authentication: Validating trigger succeeded.Operational
172MDM PushRouter Authentication: Validating nonce failed.Operational
173MDM PushRouter Authentication: Validating nonce succeeded.Operational
174MDM PushRouter Authentication: Using default nonce resync is set to false.Operational
175MDM PushRouter Authentication: Default nonce not found.Operational
176MDM PushRouter: Changing dmwappushservice startup type to demand started.Operational
177MDM PushRouter: Changing dmwappushservice startup type to demand started failed.Operational
178MDM PushRouter: Pushrouter failed to start because the dmwappushservice service …Operational
300MDM Common Utility for Policies: Policy query.Operational
301MDM Common Utility for Policies: Policy set.Operational
500DmWapPushService: Failed to retrieve ICCID of the SIM on which the message was …Operational
501DmWapPushService: Failed to copy WAP message into a format that PushRouter …Operational
502DmWapPushService: Successfully copied WAP message into a format that PushRouter …Operational
503DmWapPushService: Failed to retrieve body of WAP message.Operational
504DmWapPushService: Successfully retrieved body of WAP message.Operational
505DmWapPushService: The current value of SECPOLICY_WSPNOTIFICATIONS is: (HexInt1).Operational
506DmWapPushService: Failed to register WNF with EventAggregator for WAP messages …Operational
507DmWapPushService: Successfully registered WNF with EventAggregator for WAP …Operational
508DmWapPushService: Callback to handle a new WAP message received.Operational
509DmWapPushService: There are pending RPC clients currently.Operational
510DmWapPushService: No pending RPC clients remain.Operational
511DmWapPushService: Setting the timer to check if all RPC clients are handled to …Operational
512DmWapPushService: Idle timeout of DmWapPushService is currently set to (HexInt1) …Operational
513DmWapPushService: Initialized idle stop-start for DmWapPushService.Operational
514DmWapPushService: Service status updated.Operational
515DmWapPushService: Failed to initialize service.Operational
516DmWapPushService: Successfully initialized service.Operational
517DmWapPushService: Failed to register service's RPC interface.Operational
518DmWapPushService: Successfully registered service's RPC interface.Operational
519DmWapPushService: Failed to uninitialize service.Operational
520DmWapPushService: Successfully uninitialized service.Operational
521DmWapPushService: Failed to unregister service's RPC interface.Operational
522DmWapPushService: Successfully unregistered service's RPC interface.Operational
523DmWapPushService: Service handler invoked.Operational
524DmWapPushService: DmWapPushService is being initialized.Operational
525DmWapPushService: Stop Service handler registered.Operational

Event ID 100 — MDM PushRouter Service: Failed to create ConfigManager lock service binding.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Failed to create ConfigManager lock service binding. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to create ConfigManager lock service binding. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 101 — MDM PushRouter Service: Successfully created RPC Server Interface group.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: Successfully created RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully created RPC Server Interface group. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.736188+00:00",
    "event_record_id": 7327,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 102 — MDM PushRouter Service: Failed to create RPC Server Interface group.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Failed to create RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to create RPC Server Interface group. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 103 — MDM PushRouter Service: Failed to activate RPC Server Interface group because a duplicate end point exists.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Failed to activate RPC Server Interface group because a duplicate end point exists. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to activate RPC Server Interface group because a duplicate end point exists. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 104 — MDM PushRouter Service: Successfully activated RPC Server Interface group.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: Successfully activated RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully activated RPC Server Interface group. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 104,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.738835+00:00",
    "event_record_id": 7329,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 105 — MDM PushRouter Service: Failed to activate RPC Server Interface group.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Failed to activate RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to activate RPC Server Interface group. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 106 — MDM PushRouter Service: Successfully deactivated RPC Server Interface group.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: Successfully deactivated RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully deactivated RPC Server Interface group. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 106,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.378775+00:00",
    "event_record_id": 7376,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 107 — MDM PushRouter Service: Failed to deactivate RPC Server Interface group.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Failed to deactivate RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to deactivate RPC Server Interface group. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 108 — MDM PushRouter Service: Successfully closed RPC Server Interface group.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: Successfully closed RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully closed RPC Server Interface group. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 108,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.378898+00:00",
    "event_record_id": 7377,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 109 — MDM PushRouter Service: Failed to close RPC Server Interface group.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Failed to close RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to close RPC Server Interface group. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 110 — MDM PushRouter Service: PushRouter RPC interface Idle status changed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter RPC interface Idle status changed. Is group idle: (HexInt1).

Message #

MDM PushRouter Service: PushRouter RPC interface Idle status changed. Is group idle: (%1).

Fields #

NameDescription
HexInt1 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 110,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:53:16.062812+00:00",
    "event_record_id": 7371,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x1"
  },
  "message": ""
}

Event ID 111 — MDM PushRouter Service: Number of PushRouter clients remaining: (HRESULT).

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: Number of PushRouter clients remaining: (HRESULT). Operation: (Message1).

Message #

MDM PushRouter Service: Number of PushRouter clients remaining: (%2). Operation: (%1).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 111,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.376378+00:00",
    "event_record_id": 7373,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 9048
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "Checking if all clients are handled",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 112 — MDM PushRouter Service: All clients handled.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: All clients handled. Number of PushRouter clients remaining: (HexInt1).

Message #

MDM PushRouter Service: All clients handled. Number of PushRouter clients remaining: (%1).

Fields #

NameDescription
HexInt1 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 112,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:53:16.062830+00:00",
    "event_record_id": 7372,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x0"
  },
  "message": ""
}

Event ID 113 — MDM PushRouter Service: Number of active client count rolled over.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Number of active client count rolled over. Number of PushRouter clients remaining: (HexInt1).

Message #

MDM PushRouter Service: Number of active client count rolled over. Number of PushRouter clients remaining: (%1).

Fields #

NameDescription
HexInt1 HexInt32

Event ID 114 — MDM PushRouter Service: PushRouter RPC run down occured.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: PushRouter RPC run down occured.

Message #

MDM PushRouter Service: PushRouter RPC run down occured.

Event ID 115 — MDM PushRouter Service: PushRouter::Open called by a client needing a handle to PushRouter.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter::Open called by a client needing a handle to PushRouter.

Message #

MDM PushRouter Service: PushRouter::Open called by a client needing a handle to PushRouter.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 115,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.897771+00:00",
    "event_record_id": 7352,
    "correlation": {
      "ActivityID": "AEBE4C57-66E3-4324-8BB1-F438C2253964"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 116 — MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter succeeded. Client id: (Message1), Content Type: (Message2):, App Id: (Message3), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter succeeded. Client id: (%1), Content Type: (%2):, App Id: (%3), Result: (%4).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
Message3 UnicodeString
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 116,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.899083+00:00",
    "event_record_id": 7354,
    "correlation": {
      "ActivityID": "AEBE4C57-66E3-4324-8BB1-F438C2253964"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "PC5",
    "Message2": "application/vnd.syncml.notification",
    "Message3": "x-wap-application:syncml.dm",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 117 — MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter failed. Content Type: (Message1):, App Id: (Message2), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter failed. Content Type: (%1):, App Id: (%2), Result: (%3).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
HRESULT HexInt32

Event ID 118 — MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message origin: (HexInt1).

Message #

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message origin: (%1).

Fields #

NameDescription
HexInt1 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 118,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.740105+00:00",
    "event_record_id": 7333,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x3"
  },
  "message": ""
}

Event ID 119 — MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message submission succeeded. Sender Address: (), Content Type: (), App Id: (), Result: ().

Message #

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message submission succeeded. Sender Address: (%1), Content Type: (%2), App Id: (%3), Result: (%4).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
Message3 UnicodeString
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 119,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.765530+00:00",
    "event_record_id": 7339,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "NULL",
    "Message2": "application/vnd.syncml.notification",
    "Message3": "NULL",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 120 — MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message submission failed. Sender Address: ():, Content Type: (),App Id: (), Result: ().

Message #

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message submission failed. Sender Address: (%1):, Content Type: (%2),App Id: (%3), Result: (%4).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
Message3 UnicodeString
HRESULT HexInt32

Event ID 121 — MDM PushRouter Service: PushRouter was submitted a message by a RPC client.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter was submitted a message by a RPC client. Message submission succeeded. Message origin: (HexInt1), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter was submitted a message by a RPC client. Message submission succeeded. Message origin: (%1), Result: (%2).

Fields #

NameDescription
HexInt1 HexInt32
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 121,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.765562+00:00",
    "event_record_id": 7340,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x3",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 122 — MDM PushRouter Service: PushRouter was submitted a message by a RPC client.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: PushRouter was submitted a message by a RPC client. Message submission failed. Message origin: (HexInt1), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter was submitted a message by a RPC client. Message submission failed. Message origin: (%1), Result: (%2).

Fields #

NameDescription
HexInt1 HexInt32
HRESULT HexInt32

Event ID 123 — MDM PushRouter Service: PushRouter was created successfully.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter was created successfully. Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter was created successfully. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 123,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.897951+00:00",
    "event_record_id": 7353,
    "correlation": {
      "ActivityID": "AEBE4C57-66E3-4324-8BB1-F438C2253964"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 124 — MDM PushRouter Service: PushRouter could not be created successfully.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: PushRouter could not be created successfully. Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter could not be created successfully. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 125 — MDM PushRouter Service: Opening Service Control Manager to change PushRouter startup type failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Opening Service Control Manager to change PushRouter startup type failed. Result: ({HRESULT}).

Message #

MDM PushRouter Service: Opening Service Control Manager to change PushRouter startup type failed. Result: ({HRESULT}).

Fields #

NameDescription
HRESULT

Event ID 126 — MDM PushRouter Service: Opening service handle to change PushRouter startup type failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Opening service handle to change PushRouter startup type failed. Result: ({HRESULT}).

Message #

MDM PushRouter Service: Opening service handle to change PushRouter startup type failed. Result: ({HRESULT}).

Fields #

NameDescription
HRESULT

Event ID 127 — MDM PushRouter Service: Changing PushRouter start up type to auto start failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Changing PushRouter start up type to auto start failed. Result: (HRESULT).

Message #

MDM PushRouter Service: Changing PushRouter start up type to auto start failed. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 128 — MDM PushRouter Service: Changing PushRouter start up type to delayed auto start failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Changing PushRouter start up type to delayed auto start failed. Result: (HRESULT).

Message #

MDM PushRouter Service: Changing PushRouter start up type to delayed auto start failed. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 129 — MDM PushRouter Service: PushRouter close called by a client interacting with it succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter close called by a client interacting with it succeeded. Client id: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter close called by a client interacting with it succeeded. Client id: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 129,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:16.047385+00:00",
    "event_record_id": 7364,
    "correlation": {
      "ActivityID": "3C7B2557-A3AD-4E72-AF98-0B95D4A5B22B"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "PC5",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 130 — MDM PushRouter Service: PushRouter close called by a client interacting with it failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: PushRouter close called by a client interacting with it failed. Client id: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter close called by a client interacting with it failed. Client id: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 131 — MDM PushRouter Service: A client initiated a get message operation from PushRouter.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: A client initiated a get message operation from PushRouter.

Message #

MDM PushRouter Service: A client initiated a get message operation from PushRouter.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 131,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:06.036773+00:00",
    "event_record_id": 7363,
    "correlation": {
      "ActivityID": "7FBD6708-DDA2-4966-92A3-E43FEAE64147"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 132 — MDM PushRouter Service: A client was able to successfully get a message from PushRouter.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Message #

MDM PushRouter Service: A client was able to successfully get a message from PushRouter. Content Type: (%1), App Id: (%2), Source Address: (%3), Client ID: (%4), Security Account: (%5), Message origin: (%6), Result: (%7).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
Message3 UnicodeString
Message4 UnicodeString
Message5 UnicodeString
HexInt1 HexInt32
HexInt3 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 132,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.909201+00:00",
    "event_record_id": 7356,
    "correlation": {
      "ActivityID": "36236335-6C3A-4D79-A11A-C8A243448C83"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "application/vnd.syncml.notification",
    "Message2": "NULL",
    "Message3": "",
    "Message4": "PC5",
    "Message5": "OmaDmClient_Enterprise",
    "HexInt1": "0x3",
    "HexInt3": "0x0"
  },
  "message": ""
}

Event ID 133 — MDM PushRouter Service: A client failed to get a message from PushRouter.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: A client failed to get a message from PushRouter. Content Type: (Message1), App Id: (Message2), Source Address: (Message3), Client ID: (Message4), Message origin: (HexInt1), Result: (HexInt3).

Message #

MDM PushRouter Service: A client failed to get a message from PushRouter. Content Type: (%1), App Id: (%2), Source Address: (%3), Client ID: (%4), Message origin: (%5), Result: (%6).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
Message3 UnicodeString
Message4 UnicodeString
HexInt1 HexInt32
HexInt3 HexInt32

Event ID 134 — MDM PushRouter Service: PushRouter was instantiated.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter was instantiated.

Message #

MDM PushRouter Service: PushRouter was instantiated.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 134,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.755805+00:00",
    "event_record_id": 7337,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 135 — MDM Message Persistence: Persisted message found.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM Message Persistence: Persisted message found. Location: (Message1).

Message #

MDM Message Persistence: Persisted message found. Location: (%1).

Fields #

NameDescription
Message1 UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 135,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.740876+00:00",
    "event_record_id": 7334,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\PushRouter\\1.queue"
  },
  "message": ""
}

Event ID 136 — MDM Message Persistence: Failed to load persisted message file.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM Message Persistence: Failed to load persisted message file. Location: (Message1), Result: (HRESULT).

Message #

MDM Message Persistence: Failed to load persisted message file. Location: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 137 — MDM Message Persistence: Queue Id found for persisted message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM Message Persistence: Queue Id found for persisted message. Location: (Message1), Queue Id: (HRESULT).

Message #

MDM Message Persistence: Queue Id found for persisted message. Location: (%1), Queue Id: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 138 — MDM Message Persistence: No client found for queue Id for persisted message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM Message Persistence: No client found for queue Id for persisted message. Location: (Message1), Queue Id: (HexInt1), Result: (HRESULT).

Message #

MDM Message Persistence: No client found for queue Id for persisted message. Location: (%1), Queue Id: (%2), Result: (%3).

Fields #

NameDescription
Message1 UnicodeString
HexInt1 HexInt32
HRESULT HexInt32

Event ID 139 — MDM Message Persistence: Client found for queue Id for persisted message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM Message Persistence: Client found for queue Id for persisted message. Location: (Message1), Queue Id: (Message2), Result: (HexInt3).

Message #

MDM Message Persistence: Client found for queue Id for persisted message. Location: (%1), Queue Id: (%2), Result: (%3).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
HexInt3 HexInt32
HRESULT HexInt32

Event ID 140 — MDM Message Persistence: Client failed to launch for queue Id for persisted message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM Message Persistence: Client failed to launch for queue Id for persisted message. Location: (Message1), Client: (Message2), Queue Id: (HexInt3), Result: (HRESULT).

Message #

MDM Message Persistence: Client failed to launch for queue Id for persisted message. Location: (%1), Client: (%2), Queue Id: (%3), Result: (%4).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
HexInt3 HexInt32
HRESULT HexInt32

Event ID 141 — MDM Message Persistence: No persisted message found.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM Message Persistence: No persisted message found.Location: (Message1).

Message #

MDM Message Persistence: No persisted message found.Location: (%1).

Fields #

NameDescription
Message1 UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 141,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.741841+00:00",
    "event_record_id": 7335,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\PushRouter\\1.queue"
  },
  "message": ""
}

Event ID 142 — MDM Message Persistence: Failed to delete messages file.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM Message Persistence: Failed to delete messages file. Queue name: (Message1), Result: (HRESULT).

Message #

MDM Message Persistence: Failed to delete messages file. Queue name: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 143 — MDM Message Persistence: Failed to process persisted messages.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM Message Persistence: Failed to process persisted messages. Result: (HRESULT).

Message #

MDM Message Persistence: Failed to process persisted messages. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 144 — MDM Message Persistence: Successfully processed persisted messages.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM Message Persistence: Successfully processed persisted messages. Result: (HRESULT).

Message #

MDM Message Persistence: Successfully processed persisted messages. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 144,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.755596+00:00",
    "event_record_id": 7336,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 145 — MDM PushRouter Service: PushRouter started routing a message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter started routing a message.

Message #

MDM PushRouter Service: PushRouter started routing a message.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 145,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.820264+00:00",
    "event_record_id": 7349,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 146 — MDM PushRouter Service: Routing a message failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Routing a message failed. Content: (Message1), Application: (Message2), Sender: (Message3), Client: (Message4), Queue Id: (Message5), Result: (HexInt1).

Message #

MDM PushRouter Service: Routing a message failed. Content: (%1), Application: (%2), Sender: (%3), Client: (%4), Queue Id: (%5), Result: (%6).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
Message3 UnicodeString
Message4 UnicodeString
Message5 UnicodeString
HexInt1 HexInt32

Event ID 147 — MDM PushRouter Service: Message routed successfully.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: Message routed successfully. Content: (Message1), Application: (Message2), Sender: (Message3), Client: (Message4), Queue Id: (Message5), Result: (HexInt1).

Message #

MDM PushRouter Service: Message routed successfully. Content: (%1), Application: (%2), Sender: (%3), Client: (%4), Queue Id: (%5), Result: (%6).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
Message3 UnicodeString
Message4 UnicodeString
Message5 UnicodeString
HexInt1 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 147,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.841537+00:00",
    "event_record_id": 7350,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "application/vnd.syncml.notification",
    "Message2": "NULL",
    "Message3": "NULL",
    "Message4": "PC5",
    "Message5": "1",
    "HexInt1": "0x0"
  },
  "message": ""
}

Event ID 148 — MDM PushRouter Service: PushRouter started routing a new message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: PushRouter started routing a new message.

Message #

MDM PushRouter Service: PushRouter started routing a new message.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 148,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.765585+00:00",
    "event_record_id": 7341,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 149 — MDM PushRouter Service: Failed to route a new message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Service: Failed to route a new message. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to route a new message. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 150 — MDM PushRouter Service: Successfully routed a new message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Service: Successfully routed a new message. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully routed a new message. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 150,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.841554+00:00",
    "event_record_id": 7351,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 151 — MDM Message Persistence: Failed to load unauthenticated messages file.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM Message Persistence: Failed to load unauthenticated messages file.Queue name: (Message1), Result: (HRESULT).

Message #

MDM Message Persistence: Failed to load unauthenticated messages file.Queue name: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 152 — MDM PushRouter Authentication: Loaded an authentication provider.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Authentication: Loaded an authentication provider. Name: (Message1).

Message #

MDM PushRouter Authentication: Loaded an authentication provider. Name: (%1).

Fields #

NameDescription
Message1 UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 152,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.765605+00:00",
    "event_record_id": 7342,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "SecProviders.SyncMLSecProvider"
  },
  "message": ""
}

Event ID 153 — MDM PushRouter Authentication: Getting authentication provider failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: Getting authentication provider failed. Name: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: Getting authentication provider failed. Name: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 154 — MDM PushRouter Authentication: Loaded authentication provider failed to authenticate message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: Loaded authentication provider failed to authenticate message. Name: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: Loaded authentication provider failed to authenticate message. Name: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 155 — MDM PushRouter Authentication: Message authenticated successfully.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Authentication: Message authenticated successfully. Name: (Message1), Security account name: (Message2), Message headers: (Message3), Sender address: (Message4), Role: (HexInt1), Result: (HexInt3).

Message #

MDM PushRouter Authentication: Message authenticated successfully. Name: (%1), Security account name: (%2), Message headers: (%3), Sender address: (%4), Role: (%5), Result: (%6).

Fields #

NameDescription
Message1 UnicodeString
Message2 UnicodeString
Message3 UnicodeString
Message4 UnicodeString
HexInt1 HexInt32
HexInt3 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 155,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.811427+00:00",
    "event_record_id": 7348,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "SecProviders.SyncMLSecProvider",
    "Message2": "OmaDmClient_Enterprise",
    "Message3": "Content-Type: application/vnd.syncml.notification\r\nX-Wap-Application-Id: x-wap-application:syncml.dm",
    "Message4": "NULL",
    "HexInt1": "0x20",
    "HexInt3": "0x0"
  },
  "message": ""
}

Event ID 156 — MDM PushRouter Authentication: Message could not be authenticated.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: Message could not be authenticated. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Message could not be authenticated. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 157 — MDM PushRouter Proxy: RPC call to get a message from PushRouter failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Proxy: RPC call to get a message from PushRouter failed. Result: (HRESULT).

Message #

MDM PushRouter Proxy: RPC call to get a message from PushRouter failed. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 158 — MDM PushRouter Proxy: RPC call to get a message from PushRouter succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Proxy: RPC call to get a message from PushRouter succeeded. Result: (HRESULT).

Message #

MDM PushRouter Proxy: RPC call to get a message from PushRouter succeeded. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 159 — MDM PushRouter Proxy: RPC call to submit a message from PushRouter failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Proxy: RPC call to submit a message from PushRouter failed. Result: (HRESULT).

Message #

MDM PushRouter Proxy: RPC call to submit a message from PushRouter failed. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 160 — MDM PushRouter Proxy: RPC call to submit a message from PushRouter succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Proxy: RPC call to submit a message from PushRouter succeeded. Result: (HRESULT).

Message #

MDM PushRouter Proxy: RPC call to submit a message from PushRouter succeeded. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 161 — MDM PushRouter Authentication: Failed to get network shared secret because ICCID is null.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: Failed to get network shared secret because ICCID is null.

Message #

MDM PushRouter Authentication: Failed to get network shared secret because ICCID is null.

Event ID 162 — MDM PushRouter Authentication: WAP Verification succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: WAP Verification succeeded. Security param: (HexInt1), Security role assigned: (HexInt2), Result: (HRESULT).

Message #

MDM PushRouter Authentication: WAP Verification succeeded. Security param: (%1), Security role assigned: (%2), Result: (%3).

Fields #

NameDescription
HexInt1 HexInt32
HexInt2 HexInt32
HRESULT HexInt32

Event ID 163 — MDM PushRouter Authentication: WAP Verification failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: WAP Verification failed. Security param: (HexInt1), Security role assigned: (HexInt2), Result: (HRESULT).

Message #

MDM PushRouter Authentication: WAP Verification failed. Security param: (%1), Security role assigned: (%2), Result: (%3).

Fields #

NameDescription
HexInt1 HexInt32
HexInt2 HexInt32
HRESULT HexInt32

Event ID 164 — MDM PushRouter Authentication: WAP Authentication failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: WAP Authentication failed. Security param: (HexInt1), Policy Value: (HexInt2), Security role assigned: (HexInt3), Result: (HRESULT).

Message #

MDM PushRouter Authentication: WAP Authentication failed. Security param: (%1), Policy Value: (%2), Security role assigned: (%3), Result: (%4).

Fields #

NameDescription
HexInt1 HexInt32
HexInt2 HexInt32
HexInt3 HexInt32
HRESULT HexInt32

Event ID 165 — MDM PushRouter Authentication: WAP Authentication succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: WAP Authentication succeeded. Security param: (HexInt1), Policy Value: (HexInt2), Security role assigned: (HexInt3), Result: (HRESULT).

Message #

MDM PushRouter Authentication: WAP Authentication succeeded. Security param: (%1), Policy Value: (%2), Security role assigned: (%3), Result: (%4).

Fields #

NameDescription
HexInt1 HexInt32
HexInt2 HexInt32
HexInt3 HexInt32
HRESULT HexInt32

Event ID 166 — MDM PushRouter Authentication: SyncMl Authentication failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: SyncMl Authentication failed. Headers: (Message1), Message Body size: (HexInt1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: SyncMl Authentication failed. Headers: (%1), Message Body size: (%2), Result: (%3).

Fields #

NameDescription
Message1 UnicodeString
HexInt1 HexInt32
HRESULT HexInt32

Event ID 167 — MDM PushRouter Authentication: SyncMl Authentication succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Authentication: SyncMl Authentication succeeded. Headers: (Message1), Message Body size: (HexInt1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: SyncMl Authentication succeeded. Headers: (%1), Message Body size: (%2), Result: (%3).

Fields #

NameDescription
Message1 UnicodeString
HexInt1 HexInt32
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 167,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.811409+00:00",
    "event_record_id": 7347,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "Content-Type: application/vnd.syncml.notification\r\nX-Wap-Application-Id: x-wap-application:syncml.dm",
    "HexInt1": "0x3c",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 168 — MDM PushRouter Authentication: Getting ServerID from the trigger failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: Getting ServerID from the trigger failed. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Getting ServerID from the trigger failed. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 169 — MDM PushRouter Authentication: Getting ServerID from the trigger succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Authentication: Getting ServerID from the trigger succeeded. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Getting ServerID from the trigger succeeded. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 169,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.810524+00:00",
    "event_record_id": 7346,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 170 — MDM PushRouter Authentication: Validating trigger failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: Validating trigger failed. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Validating trigger failed. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 171 — MDM PushRouter Authentication: Validating trigger succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Authentication: Validating trigger succeeded. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Validating trigger succeeded. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 171,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.810506+00:00",
    "event_record_id": 7345,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 172 — MDM PushRouter Authentication: Validating nonce failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: Validating nonce failed. Type of nonce: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: Validating nonce failed. Type of nonce: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 173 — MDM PushRouter Authentication: Validating nonce succeeded.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM PushRouter Authentication: Validating nonce succeeded. Type of nonce: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: Validating nonce succeeded. Type of nonce: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 173,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.810461+00:00",
    "event_record_id": 7344,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "Regular",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 174 — MDM PushRouter Authentication: Using default nonce resync is set to false.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: Using default nonce resync is set to false.

Message #

MDM PushRouter Authentication: Using default nonce resync is set to false.

Event ID 175 — MDM PushRouter Authentication: Default nonce not found.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter Authentication: Default nonce not found.

Message #

MDM PushRouter Authentication: Default nonce not found.

Event ID 176 — MDM PushRouter: Changing dmwappushservice startup type to demand started.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter: Changing dmwappushservice startup type to demand started. Result: (HRESULT).

Message #

MDM PushRouter: Changing dmwappushservice startup type to demand started. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 177 — MDM PushRouter: Changing dmwappushservice startup type to demand started failed.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter: Changing dmwappushservice startup type to demand started failed. Result: (HRESULT).

Message #

MDM PushRouter: Changing dmwappushservice startup type to demand started failed. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 178 — MDM PushRouter: Pushrouter failed to start because the dmwappushservice service is disabled.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM PushRouter: Pushrouter failed to start because the dmwappushservice service is disabled.

Message #

MDM PushRouter: Pushrouter failed to start because the dmwappushservice service is disabled.

Event ID 300 — MDM Common Utility for Policies: Policy query.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

MDM Common Utility for Policies: Policy query. Policy ID: (HexInt1), Policy Value: (HexInt2), Result: (HRESULT).

Message #

MDM Common Utility for Policies: Policy query. Policy ID: (%1), Policy Value: (%2), Result: (%3).

Fields #

NameDescription
HexInt1 HexInt32
HexInt2 HexInt32
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:02.145061+00:00",
    "event_record_id": 7357,
    "correlation": {},
    "execution": {
      "process_id": 6736,
      "thread_id": 11860
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x1022",
    "HexInt2": "0x0",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 301 — MDM Common Utility for Policies: Policy set.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

MDM Common Utility for Policies: Policy set. Policy ID: (HexInt1), Policy Value: (HexInt2), Result: (HRESULT).

Message #

MDM Common Utility for Policies: Policy set. Policy ID: (%1), Policy Value: (%2), Result: (%3).

Fields #

NameDescription
HexInt1 HexInt32
HexInt2 HexInt32
HRESULT HexInt32

Event ID 500 — DmWapPushService: Failed to retrieve ICCID of the SIM on which the message was received.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Failed to retrieve ICCID of the SIM on which the message was received. Result: (HRESULT).

Message #

DmWapPushService: Failed to retrieve ICCID of the SIM on which the message was received. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 501 — DmWapPushService: Failed to copy WAP message into a format that PushRouter understands.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Failed to copy WAP message into a format that PushRouter understands.ICCID: (Message1), Result: (HRESULT).

Message #

DmWapPushService: Failed to copy WAP message into a format that PushRouter understands.ICCID: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 502 — DmWapPushService: Successfully copied WAP message into a format that PushRouter understands.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Successfully copied WAP message into a format that PushRouter understands.ICCID: (Message1), Result: (HRESULT).

Message #

DmWapPushService: Successfully copied WAP message into a format that PushRouter understands.ICCID: (%1), Result: (%2).

Fields #

NameDescription
Message1 UnicodeString
HRESULT HexInt32

Event ID 503 — DmWapPushService: Failed to retrieve body of WAP message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Failed to retrieve body of WAP message. Result: (HRESULT).

Message #

DmWapPushService: Failed to retrieve body of WAP message. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 504 — DmWapPushService: Successfully retrieved body of WAP message.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Successfully retrieved body of WAP message. Result: (HRESULT).

Message #

DmWapPushService: Successfully retrieved body of WAP message. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 505 — DmWapPushService: The current value of SECPOLICY_WSPNOTIFICATIONS is: (HexInt1).

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: The current value of SECPOLICY_WSPNOTIFICATIONS is: (HexInt1).

Message #

DmWapPushService: The current value of SECPOLICY_WSPNOTIFICATIONS is: (%1).

Fields #

NameDescription
HexInt1 HexInt32

Event ID 506 — DmWapPushService: Failed to register WNF with EventAggregator for WAP messages received by SMS Router.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Error

Description

DmWapPushService: Failed to register WNF with EventAggregator for WAP messages received by SMS Router. Result: (HexInt1).

Message #

DmWapPushService: Failed to register WNF with EventAggregator for WAP messages received by SMS Router. Result: (%1).

Fields #

NameDescription
HexInt1 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 506,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:43:24.011193+00:00",
    "event_record_id": 10,
    "correlation": {},
    "execution": {
      "process_id": 14788,
      "thread_id": 14400
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0xc002000b"
  },
  "message": ""
}

Event ID 507 — DmWapPushService: Successfully registered WNF with EventAggregator for WAP messages received by SMS Router.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Successfully registered WNF with EventAggregator for WAP messages received by SMS Router. Result: (HexInt1).

Message #

DmWapPushService: Successfully registered WNF with EventAggregator for WAP messages received by SMS Router. Result: (%1).

Fields #

NameDescription
HexInt1 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 507,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.736008+00:00",
    "event_record_id": 7325,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x0"
  },
  "message": ""
}

Event ID 508 — DmWapPushService: Callback to handle a new WAP message received.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Callback to handle a new WAP message received.

Message #

DmWapPushService: Callback to handle a new WAP message received.

Event ID 509 — DmWapPushService: There are pending RPC clients currently.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: There are pending RPC clients currently.

Message #

DmWapPushService: There are pending RPC clients currently.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 509,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:53:01.369389+00:00",
    "event_record_id": 7367,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 510 — DmWapPushService: No pending RPC clients remain.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: No pending RPC clients remain.

Message #

DmWapPushService: No pending RPC clients remain.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 510,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.378179+00:00",
    "event_record_id": 7374,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 9048
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 511 — DmWapPushService: Setting the timer to check if all RPC clients are handled to fire after (HexInt1) seconds.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Setting the timer to check if all RPC clients are handled to fire after (HexInt1) seconds.

Message #

DmWapPushService: Setting the timer to check if all RPC clients are handled to fire after (%1) seconds.

Fields #

NameDescription
HexInt1 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 511,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:53:01.369414+00:00",
    "event_record_id": 7368,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x78"
  },
  "message": ""
}

Event ID 512 — DmWapPushService: Idle timeout of DmWapPushService is currently set to (HexInt1) seconds.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Idle timeout of DmWapPushService is currently set to (HexInt1) seconds.

Message #

DmWapPushService: Idle timeout of DmWapPushService is currently set to (%1) seconds.

Fields #

NameDescription
HexInt1 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 512,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.374089+00:00",
    "event_record_id": 7319,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x78"
  },
  "message": ""
}

Event ID 513 — DmWapPushService: Initialized idle stop-start for DmWapPushService.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Initialized idle stop-start for DmWapPushService.

Message #

DmWapPushService: Initialized idle stop-start for DmWapPushService.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 513,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.379453+00:00",
    "event_record_id": 7379,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 514 — DmWapPushService: Service status updated.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Service status updated. Current state: (HexInt1), Exit code: (HexInt2), Wait hint: (HexInt3).

Message #

DmWapPushService: Service status updated. Current state: (%1), Exit code: (%2), Wait hint: (%3).

Fields #

NameDescription
HexInt1 HexInt32
HexInt2 HexInt32
HexInt3 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 514,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.379563+00:00",
    "event_record_id": 7381,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x1",
    "HexInt2": "0x0",
    "HexInt3": "0x0"
  },
  "message": ""
}

Event ID 515 — DmWapPushService: Failed to initialize service.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Failed to initialize service. Result: (HRESULT).

Message #

DmWapPushService: Failed to initialize service. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 516 — DmWapPushService: Successfully initialized service.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Successfully initialized service. Result: (HRESULT).

Message #

DmWapPushService: Successfully initialized service. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 516,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.736031+00:00",
    "event_record_id": 7326,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 517 — DmWapPushService: Failed to register service's RPC interface.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Failed to register service's RPC interface. Result: (HRESULT).

Message #

DmWapPushService: Failed to register service's RPC interface. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 518 — DmWapPushService: Successfully registered service's RPC interface.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Successfully registered service's RPC interface. Result: (HRESULT).

Message #

DmWapPushService: Successfully registered service's RPC interface. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 518,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.738848+00:00",
    "event_record_id": 7330,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 519 — DmWapPushService: Failed to uninitialize service.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Failed to uninitialize service. Result: (HRESULT).

Message #

DmWapPushService: Failed to uninitialize service. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 520 — DmWapPushService: Successfully uninitialized service.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Successfully uninitialized service. Result: (HRESULT).

Message #

DmWapPushService: Successfully uninitialized service. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 520,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.379544+00:00",
    "event_record_id": 7380,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 521 — DmWapPushService: Failed to unregister service's RPC interface.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational

Description

DmWapPushService: Failed to unregister service's RPC interface. Result: (HRESULT).

Message #

DmWapPushService: Failed to unregister service's RPC interface. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Event ID 522 — DmWapPushService: Successfully unregistered service's RPC interface.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Successfully unregistered service's RPC interface. Result: (HRESULT).

Message #

DmWapPushService: Successfully unregistered service's RPC interface. Result: (%1).

Fields #

NameDescription
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 522,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.378914+00:00",
    "event_record_id": 7378,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 523 — DmWapPushService: Service handler invoked.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Service handler invoked. Opcode: (HexInt1), Current state: (HexInt2).

Message #

DmWapPushService: Service handler invoked. Opcode: (%1), Current state: (%2).

Fields #

NameDescription
HexInt1 HexInt32
HexInt2 HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 523,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T23:52:08.830793+00:00",
    "event_record_id": 7132,
    "correlation": {},
    "execution": {
      "process_id": 6116,
      "thread_id": 8576
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x4",
    "HexInt2": "0x4"
  },
  "message": ""
}

Event ID 524 — DmWapPushService: DmWapPushService is being initialized.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: DmWapPushService is being initialized.

Message #

DmWapPushService: DmWapPushService is being initialized.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 524,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.373899+00:00",
    "event_record_id": 7317,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 525 — DmWapPushService: Stop Service handler registered.

Provider
Microsoft-Windows-DeviceManagement-Pushrouter
Channel
Operational
Level
Informational

Description

DmWapPushService: Stop Service handler registered. Status: (HexInt1), Result: (HRESULT).

Message #

DmWapPushService: Stop Service handler registered. Status: (%1), Result: (%2).

Fields #

NameDescription
HexInt1 HexInt32
HRESULT HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 525,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.738885+00:00",
    "event_record_id": 7331,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x0",
    "HRESULT": "0x0"
  },
  "message": ""
}