Microsoft-Windows-Immersive-Shell
899 events across 4 channels
Event ID 101 — The shell is starting up.
Event ID 102 — The shell startup sequence completed with result Result.
Event ID 105 —
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "315A8872-923E-4EA2-9889-33CD4754BF64",
"event_source_name": "",
"event_id": 105,
"version": 0,
"level": 4,
"task": 104,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2023-11-05T22:31:33.068651+00:00",
"event_record_id": 10,
"correlation": {},
"execution": {
"process_id": 5484,
"thread_id": 7212
},
"channel": "Microsoft-Windows-TWinUI/Operational",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
}
},
"event_data": {},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 111 — The shell is starting up, the shell component with table index ComponentClsid is InitalizationStep, current result (Result).
Event ID 112 — The shell is starting up, the shell component with table index ComponentClsid is InitalizationStep, current result (Result).
Event ID 113 — The shell is shutting down; the shell component with table index {TableEntryIndex} (in the fixed table) is {InitalizationStep}; current result.
Event ID 114 — The shell is shutting down; the shell component with table index {TableEntryIndex} (in the fixed table) is {InitalizationStep}; current result.
Event ID 121 —
Fields #
| Name | Description |
|---|---|
SystemModeFrom Int32 | — |
SystemSubModeFrom Int32 | — |
SystemModeTo Int32 | — |
SystemSubModeTo Int32 | — |
Event ID 122 —
Fields #
| Name | Description |
|---|---|
SystemModeFrom Int32 | — |
SystemSubModeFrom Int32 | — |
SystemModeTo Int32 | — |
SystemSubModeTo Int32 | — |
Event ID 123 —
Fields #
| Name | Description |
|---|---|
ZbandFrom Int32 | — |
ZbandTo Int32 | — |
Event ID 124 —
Fields #
| Name | Description |
|---|---|
ZbandFrom Int32 | — |
ZbandTo Int32 | — |
Event ID 125 —
Fields #
| Name | Description |
|---|---|
ListenerIndex UInt32 | — |
Event ID 126 —
Fields #
| Name | Description |
|---|---|
ListenerIndex UInt32 | — |
Result UInt32 | — |
Event ID 141 —
Fields #
| Name | Description |
|---|---|
ListenerIndex UInt32 | — |
Event ID 142 —
Fields #
| Name | Description |
|---|---|
ListenerIndex UInt32 | — |
Event ID 145 —
Event ID 146 —
Event ID 147 —
Event ID 148 —
Event ID 151 —
Event ID 152 —
Event ID 153 —
Fields #
| Name | Description |
|---|---|
BandID UInt32 | — |
OuterWorkArea_left Int32 | — |
OuterWorkArea_top Int32 | — |
OuterWorkArea_right Int32 | — |
OuterWorkArea_bottom Int32 | — |
InnerWorkArea_left Int32 | — |
InnerWorkArea_top Int32 | — |
InnerWorkArea_right Int32 | — |
InnerWorkArea_bottom Int32 | — |
Event ID 154 — Layout Manager: Initialization
Description
Layout Manager: Initialization.
Message #
Event ID 155 — Layout Manager: Initialization
Description
Layout Manager: Initialization.
Message #
Event ID 156 — Layout Manager Invalidation has occurred
Event ID 161 —
Fields #
| Name | Description |
|---|---|
FocusedHWND Pointer | — |
IHMPosition_left Int32 | — |
IHMPosition_top Int32 | — |
IHMPosition_right Int32 | — |
IHMPosition_bottom Int32 | — |
Event ID 162 —
Fields #
| Name | Description |
|---|---|
FocusedHWND Pointer | — |
IHMPosition_left Int32 | — |
IHMPosition_top Int32 | — |
IHMPosition_right Int32 | — |
IHMPosition_bottom Int32 | — |
Event ID 163 —
Fields #
| Name | Description |
|---|---|
FocusedHWND Pointer | — |
IHMPosition_left Int32 | — |
IHMPosition_top Int32 | — |
IHMPosition_right Int32 | — |
IHMPosition_bottom Int32 | — |
Event ID 164 —
Event ID 165 —
Fields #
| Name | Description |
|---|---|
NotificationType Int32 | — |
FocusedHWND Pointer | — |
IHMPosition_left Int32 | — |
IHMPosition_top Int32 | — |
IHMPosition_right Int32 | — |
IHMPosition_bottom Int32 | — |
Event ID 166 —
Fields #
| Name | Description |
|---|---|
NotificationType Int32 | — |
FocusedHWND Pointer | — |
IHMPosition_left Int32 | — |
IHMPosition_top Int32 | — |
IHMPosition_right Int32 | — |
IHMPosition_bottom Int32 | — |
Event ID 171 — Application state change for AppID: ApplicationState.
Event ID 173 —
Fields #
| Name | Description |
|---|---|
Window Int32 | — |
Title UnicodeString | — |
Event ID 181 —
Fields #
| Name | Description |
|---|---|
Left Int32 | — |
Top Int32 | — |
UIName UnicodeString | — |
Event ID 1003 — The parsing of the tile notification XML payload has failed.
Description
The parsing of the tile notification XML payload has failed.
Message #
Event ID 1004 — The notification payload does not have a template definition for the current tile size
Description
The notification payload does not have a template definition for the current tile size.
Message #
Event ID 1013 —
Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | — |
NotificationId UInt32 | — |
HRESULT UInt32 | — |
Unprocessed Resource String UnicodeString | — |
Processed Resource String UnicodeString | — |
UnprocessedResourceString UnicodeString | — |
ProcessedResourceString UnicodeString | — |
Event ID 1014 — The notification payload exceeds the maximum allowed size
Description
The notification payload exceeds the maximum allowed size.
Message #
Event ID 1015 — The notification payload is too small to process
Description
The notification payload is too small to process.
Message #
Event ID 1016 — The notification payload has an unsupported or invalid unicode byte order mark
Description
The notification payload has an unsupported or invalid unicode byte order mark.
Message #
Event ID 1017 — The notification payload contains unknown or invalid attributes
Description
The notification payload contains unknown or invalid attributes.
Message #
Event ID 1018 — The notification payload contains a given tag more times than is allowed by the specification
Description
The notification payload contains a given tag more times than is allowed by the specification.
Message #
Event ID 1019 — The notification payload contains an unknown or invalid element
Description
The notification payload contains an unknown or invalid element.
Message #
Event ID 1020 — The notification payload contains text within a tag that does not allow it
Description
The notification payload contains text within a tag that does not allow it.
Message #
Event ID 1021 — The notification payload contains more than one visual element
Description
The notification payload contains more than one visual element.
Message #
Event ID 1022 — The notification payload's active binding element has a contentId that matches an exising notification
Description
The notification payload's active binding element has a contentId that matches an exising notification.
Message #
Event ID 1023 — The version 1 notification has an illegal value for its template or fallback attribute
Description
The version 1 notification has an illegal value for its template or fallback attribute.
Message #
Event ID 1024 — The notification's template attribute is not recognized in this version of Windows.
Description
The notification's template attribute is not recognized in this version of Windows. Using the fallback template.
Message #
Event ID 1025 — Successfully resolved the notification template attribute for this version of Windows
Description
Successfully resolved the notification template attribute for this version of Windows.
Message #
Event ID 1026 — Unable to resolve the notification template attribute for this version of Windows
Description
Unable to resolve the notification template attribute for this version of Windows.
Message #
Event ID 1027 — All payload content was clipped at the current tile size.
Event ID 1201 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
NotificationID UInt32 | — |
Event ID 1202 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
NotificationID UInt32 | — |
Event ID 1203 — The parsing of the badge notification XML payload has failed.
Event ID 1310 —
Fields #
| Name | Description |
|---|---|
AppUserModelID UnicodeString | — |
Left UInt32 | — |
Top UInt32 | — |
Right UInt32 | — |
Bottom UInt32 | — |
Event ID 1315 —
Event ID 1316 —
Event ID 1317 —
Fields #
| Name | Description |
|---|---|
AppUserModelId UnicodeString | — |
Arguments UnicodeString | — |
NotificationTargetId UnicodeString | — |
Event ID 1318 —
Fields #
| Name | Description |
|---|---|
AppUserModelId UnicodeString | — |
Arguments UnicodeString | — |
NotificationTargetId UnicodeString | — |
HRESULT UInt32 | — |
Event ID 1401 —
Event ID 1402 —
Fields #
| Name | Description |
|---|---|
AppUserModelID UnicodeString | — |
Event ID 1403 —
Event ID 1405 —
Event ID 1406 —
Event ID 1408 —
Fields #
| Name | Description |
|---|---|
AppUserModelID UnicodeString | — |
Event ID 1460 —
Event ID 1461 —
Event ID 1462 —
Fields #
| Name | Description |
|---|---|
ID UInt32 | — |
Left Int32 | — |
Top Int32 | — |
Right Int32 | — |
Bottom Int32 | — |
Event ID 1463 —
Fields #
| Name | Description |
|---|---|
ID UInt32 | — |
Left Int32 | — |
Top Int32 | — |
Right Int32 | — |
Bottom Int32 | — |
Event ID 1470 —
Event ID 1471 —
Event ID 1472 —
Event ID 1473 —
Event ID 1474 —
Event ID 1476 —
Event ID 1477 —
Fields #
| Name | Description |
|---|---|
HashValue UInt32 | — |
HashInput UnicodeString | — |
Event ID 1601 —
Fields #
| Name | Description |
|---|---|
AppUserModelID UnicodeString | — |
Event ID 1602 —
Fields #
| Name | Description |
|---|---|
AppUserModelID UnicodeString | — |
Event ID 1603 —
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "{315a8872-923e-4ea2-9889-33cd4754bf64}",
"event_source_name": "",
"event_id": "1603",
"version": "0",
"level": "4",
"task": "1603",
"opcode": "1",
"keywords": 9223372036854775808,
"time_created": "2026-03-16T00:22:36.589439400+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{a60e3c42-2c57-4b04-b4b5-493e577d516d}"
},
"execution": {
"process_id": "7124",
"thread_id": "9460"
},
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 1604 —
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "{315a8872-923e-4ea2-9889-33cd4754bf64}",
"event_source_name": "",
"event_id": "1604",
"version": "0",
"level": "4",
"task": "1603",
"opcode": "2",
"keywords": 9223372036854775808,
"time_created": "2026-03-16T00:22:36.867962200+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{a60e3c42-2c57-4b04-b4b5-493e577d516d}"
},
"execution": {
"process_id": "7124",
"thread_id": "9460"
},
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 1605 —
Event ID 1606 —
Event ID 1609 —
Event ID 1610 —
Event ID 1611 —
Event ID 1612 —
Fields #
| Name | Description |
|---|---|
StoreType UInt32 | — |
Event ID 1613 —
Event ID 1614 —
Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | — |
Arguments UnicodeString | — |
Event ID 1615 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
Event Int32 | — |
Event ID 1617 —
Event ID 1618 —
Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | — |
Arguments UnicodeString | — |
Event ID 1619 —
Fields #
| Name | Description |
|---|---|
AHE_TYPE UInt32 | — |
HRESULT UInt32 | — |
Event ID 1621 — Activation of app ApplicationId attempted.
#Description
Activation of app ApplicationId attempted. Execution state: ExecutionState, AppState, Result.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | — |
ExecutionState UInt32 | 1 attempted. Execution state. |
AppState UInt32 | — |
Result Int32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "315A8872-923E-4EA2-9889-33CD4754BF64",
"event_source_name": "",
"event_id": 1621,
"version": 0,
"level": 4,
"task": 1613,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2023-11-05T23:40:57.847667+00:00",
"event_record_id": 13,
"correlation": {},
"execution": {
"process_id": 5044,
"thread_id": 10784
},
"channel": "Microsoft-Windows-TWinUI/Operational",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
}
},
"event_data": {
"ApplicationId": "CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc!ubuntuonwindows",
"ExecutionState": 1,
"AppState": 0,
"Result": 0
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 1622 —
Fields #
| Name | Description |
|---|---|
Operation UInt32 | — Known values
|
TargetAppID UnicodeString | — |
RefAppID UnicodeString | — |
ModifyFlags UInt32 | — |
ViewOrSize UInt32 | — |
GroupName UnicodeString | — |
Event ID 1623 —
Fields #
| Name | Description |
|---|---|
ItemsToProcess UInt32 | — |
StartTask Boolean | — |
HRESULT UInt32 | — |
Event ID 1624 —
Fields #
| Name | Description |
|---|---|
ItemsToProcess UInt32 | — |
Retry Boolean | — |
FailedAttempts UInt32 | — |
HRESULT UInt32 | — |
Event ID 1625 —
Event ID 1626 — Activation of app AppID will be attempted with refreshed data, result Result.
Event ID 1627 — Starting to remove package with full name Package.
Event ID 1628 — Removing package with family name Package completed with result Result.
Event ID 1629 — Looking up package for {Package} resulted in error {Result}.
Event ID 1630 —
Event ID 1631 —
Fields #
| Name | Description |
|---|---|
Package UnicodeString | — |
Result UInt32 | — |
Event ID 1632 — Failed to launch ApplicationId.
Event ID 1702 — Toast Manager Initializing completed with status : {OperationStatus}.
Event ID 1705 — Session creation with Windows Notification Platform completed with status : {OperationStatus}.
Event ID 1707 — The start position for Toast Layout has been set to - {X-Position} [x]; {Y-Position} [y].
Description
The start position for Toast Layout has been set to - {X-Position} [x]; {Y-Position} [y].
Message #
Event ID 1709 — The max display limit for Toast Layout has been set to - {DisplayLimit}.
Event ID 1711 — The Toast opaque state duration for has been set to - {OpaqueStateDuration}.
Event ID 1713 — A size for Toasts has been set to - {ToastHeight} [height]; {ToastWidth} [width].
Event ID 1718 — Starting to Process the payload for the Notification Id : {NotificationId}.
Event ID 1719 — Completed processing the payload for the Notification Id : {NotificationId}; App Type {AppType} with Status {OperationStatus}.
Event ID 1721 — Starting to render UI for the Notification Id : {NotificationId}.
Event ID 1722 — The Toast Position for the Notification Id : {NotificationId} is - {X-Position} [x]; {Y-Position} [y].
Event ID 1723 — The Toast Display Index for the Notification Id : {NotificationId} is {DisplayIndex}.
Event ID 1724 — Completed rendering UI for the Notification Id : {NotificationId}; App Type {AppType} with Status {OperationStatus}.
Event ID 1726 — Unable to display Toast for the Notification Id : {NotificationId} as the number of Toasts displayed has reached the max display limit.
Event ID 1728 — Toast for Notification Id {NotificationId} is entering the Opaque State.
Event ID 1729 — Toast for Notification Id {NotificationId} is leaving the Opaque State.
Event ID 1731 — Toast for Notification Id {NotificationId} is entering the Decay State.
Event ID 1732 — Toast for Notification Id {NotificationId} is leaving the Decay State.
Event ID 1734 — Toast for Notification Id {NotificationId} is entering the Working State.
Event ID 1735 — Toast for Notification Id {NotificationId} is leaving the Working State.
Event ID 1737 — User has Activated the Toast for Notification Id {NotificationId}; App Type {AppType}.
Event ID 1738 — Error rendering UI for the Notification Id : {NotificationId}; App Type {AppType}.
Event ID 1740 — User has Dismissed the Toast for Notification Id {NotificationId}.
Event ID 1742 — Starting to remove the Toast for Notification Id {NotificationId} from Display.
Event ID 1743 — Completed removing the Toast for Notification Id {NotificationId} from Display.
Event ID 1745 — The Toast for Notification Id {NotificationId} is completely Opaque and the Close Button has appeared.
Event ID 1747 — Rearranging displayed toasts owing to change in layout.
Description
Rearranging displayed toasts owing to change in layout. The new start position is - {X-Position} [x]; {Y-Position} [y].
Message #
Event ID 1749 — Completed Parsing the payload XML for the Notification Id : {NotificationId}; App Type {AppType} with Status {OperationStatus}.
Event ID 1750 — API To generate Tile Rendering Data for the Notification Id : {NotificationId}; App Type {AppType} completed with Status {OperationStatus}.
Event ID 1751 — Error Receiving tile rendering info for the Notification Id : {NotificationId}; App Type {AppType}.
Event ID 1752 — Received tile rendering info for the Notification Id : {NotificationId}; App Type {AppType} with Status {OperationStatus}.
Event ID 1754 — Calling MediaEngine-Play() on Path : {FilePath} for Notification Id : {NotificationId}.
Event ID 1755 — Attempt to MediaEngine-Play() on Path : {FilePath} for Notification Id : {NotificationId} conflicted with playback for Notification Id : {PlayingNo...
Event ID 1756 — Calling MediaEngine-Stop() on Notification Id : {NotificationId}.
Event ID 1757 — Playback for Notification Id : {NotificationId} has completed successfully.
Event ID 1758 — Error received during playback for Notification Id : {NotificationId}.
Event ID 1759 — The Toast Display Index no longer occupied by the Notification Id : {NotificationId} is {DisplayIndex}.
Event ID 1760 — The Toast with Notification Id : {NotificationId} has been queued as overflow.
Event ID 1761 — The Toast with Notification Id : {NotificationId} has been removed from the overflow queue.
Event ID 1762 — The Toast with Notification Id : {NotificationId} has been cancelled.
Event ID 1763 — Cancel Request for Toast with Notification Id : {NotificationId} has been received.
Event ID 1764 — Cancel Request for Toast with Notification Id : {NotificationId} has been stored.
Event ID 1765 — Toast with Notification Id : {NotificationId} has been frozen/thawed.
Event ID 1766 — Error Parsing the payload XML for the Notification Id : {NotificationId}; App Type {AppType}.
Event ID 1767 — Error Activating Application.
Event ID 1769 — The Toast with Notification Id : {NotificationId} has been queued as VoIP overflow.
Event ID 1770 — The Toast with Notification Id : {NotificationId} has been removed from the VoIP overflow queue.
Event ID 1772 — Toast FadeIn Animation started for Notification Id : {NotificationId}.
Event ID 1773 — Toast FadeIn Animation stopped for Notification Id : {NotificationId}.
Event ID 1775 — Toast FadeOut Animation started for Notification Id : {NotificationId}.
Event ID 1776 — Toast FadeOut Animation stopped for Notification Id : {NotificationId}.
Event ID 1778 — Toast Entry Animation started for Notification Id : {NotificationId}.
Event ID 1779 — Toast Entry Animation stopped for Notification Id : {NotificationId}.
Event ID 1781 — Toast Exit Animation started for Notification Id : {NotificationId}.
Event ID 1782 — Toast Exit Animation stopped for Notification Id : {NotificationId}.
Event ID 1784 — Toast Reposition Animation started for Notification Id : {NotificationId}.
Event ID 1785 — Toast Reposition Animation stopped for Notification Id : {NotificationId}.
Event ID 1787 — Toast TapUp Animation started for Notification Id : {NotificationId}.
Event ID 1788 — Toast TapUp Animation stopped for Notification Id : {NotificationId}.
Event ID 1790 — Toast TapDown Animation started for Notification Id : {NotificationId}.
Event ID 1791 — Toast TapDown Animation stopped for Notification Id : {NotificationId}.
Event ID 1792 — The Alarm Toast with Notification Id : {NotificationId} that was pending has now been displayed and removed from the pending slot.
Event ID 1793 — Canceling Alarm Toast with Notification Id : {OutgoingNotificationId} to replace it wilth Alarm Toast with Notification Id : {IncomingNotificationId}.
Event ID 1794 — The Alarm Toast with Notification Id : {NotificationId} has been set as the pending alarm.
Event ID 1830 — Notifications have been paused for this tile.
Event ID 1833 — Notifications have been resumed for this tile.
Event ID 1843 — Notifications have been cleared for this tile.
Description
Notifications have been cleared for this tile.
Message #
Event ID 1844 —
Fields #
| Name | Description |
|---|---|
Language UnicodeString | — |
Event ID 1845 —
Fields #
| Name | Description |
|---|---|
Language UnicodeString | — |
Result UInt32 | — |
Event ID 1858 — The Windows Notification platform has failed initialization.
Event ID 1864 — Failed to download image for tile notification.
Event ID 1865 — Failed to present the notification for this tile.
Event ID 2037 — Creation of a tile UI object has failed.
Description
Creation of a tile UI object has failed.
Message #
Event ID 2038 — The updating of a tile UI object has failed.
Description
The updating of a tile UI object has failed.
Message #
Event ID 2100 —
Fields #
| Name | Description |
|---|---|
PickerType UInt32 | — |
Mode UInt32 | — |
Event ID 2102 —
Event ID 2104 —
Event ID 2106 —
Event ID 2108 —
Event ID 2110 —
Fields #
| Name | Description |
|---|---|
IsEnabled Boolean | — |
Event ID 2112 —
Event ID 2113 —
Event ID 2114 —
Event ID 2116 —
Event ID 2117 —
Event ID 2118 —
Event ID 2119 —
Event ID 2120 —
Event ID 2124 —
Event ID 2126 —
Event ID 2127 —
Event ID 2128 —
Event ID 2129 —
Fields #
| Name | Description |
|---|---|
TotalCount UInt32 | — |
Event ID 2130 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
PackageName UnicodeString | — |
Event ID 2131 —
Event ID 2132 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
PackageName UnicodeString | — |
Event ID 2133 —
Fields #
| Name | Description |
|---|---|
TotalCount UInt32 | — |
Event ID 2134 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
PackageName UnicodeString | — |
Event ID 2135 —
Event ID 2136 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
PackageName UnicodeString | — |
Event ID 2137 —
Fields #
| Name | Description |
|---|---|
TotalCount UInt32 | — |
Event ID 2138 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
PackageName UnicodeString | — |
Event ID 2139 —
Event ID 2140 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
PackageName UnicodeString | — |
Event ID 2141 —
Fields #
| Name | Description |
|---|---|
TotalCount UInt32 | — |
Event ID 2146 —
Event ID 2147 —
Event ID 2148 —
Event ID 2149 —
Fields #
| Name | Description |
|---|---|
TotalCount UInt32 | — |
Event ID 2150 —
Event ID 2151 —
Event ID 2152 —
Event ID 2153 —
Fields #
| Name | Description |
|---|---|
TotalCount UInt32 | — |
Event ID 2160 —
Event ID 2163 —
Fields #
| Name | Description |
|---|---|
IsCancelled Boolean | — |
Event ID 2164 —
Event ID 2165 —
Event ID 2166 —
Event ID 2167 —
Event ID 2168 —
Fields #
| Name | Description |
|---|---|
ClientAllowsUX Boolean | — |
FileIsUpdated Boolean | — |
Event ID 2169 —
Event ID 2170 —
Event ID 2171 —
Event ID 2172 —
Event ID 2173 —
Event ID 2174 —
Event ID 2175 —
Fields #
| Name | Description |
|---|---|
Status UInt32 | — NTSTATUS reference |
Event ID 2176 —
Event ID 2177 —
Fields #
| Name | Description |
|---|---|
ContentId UnicodeString | — |
Event ID 2178 —
Fields #
| Name | Description |
|---|---|
Status UInt32 | — NTSTATUS reference |
Event ID 2179 —
Fields #
| Name | Description |
|---|---|
FileName UnicodeString | — |
Event ID 2180 —
Event ID 2184 —
Event ID 2185 —
Event ID 2200 —
Event ID 2201 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2202 —
Event ID 2203 —
Fields #
| Name | Description |
|---|---|
AppItemCount UInt32 | — |
TotalItemCount UInt32 | — |
Result UInt32 | — |
Event ID 2204 —
Fields #
| Name | Description |
|---|---|
Index UInt32 | — |
AppItemCount UInt32 | — |
Event ID 2205 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2206 —
Fields #
| Name | Description |
|---|---|
Index UInt32 | — |
AppItemCount UInt32 | — |
Event ID 2207 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2208 —
Fields #
| Name | Description |
|---|---|
Index UInt32 | — |
AppItemCount UInt32 | — |
Event ID 2209 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2214 —
Event ID 2215 —
Fields #
| Name | Description |
|---|---|
TargetCount UInt32 | — |
Event ID 2216 —
Fields #
| Name | Description |
|---|---|
Index UInt32 | — |
Event ID 2217 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2218 —
Event ID 2219 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2222 —
Event ID 2223 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2224 —
Event ID 2225 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2226 —
Event ID 2227 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2228 —
Event ID 2229 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2232 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2235 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2236 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2238 —
Event ID 2239 —
Event ID 2240 —
Event ID 2241 —
Event ID 2244 —
Event ID 2245 —
Event ID 2246 —
Event ID 2247 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 2248 —
Fields #
| Name | Description |
|---|---|
HWND UInt32 | — |
Event ID 2249 —
Fields #
| Name | Description |
|---|---|
HWND UInt32 | — |
Event ID 2250 —
Event ID 2251 —
Event ID 2252 —
Event ID 2253 —
Event ID 2254 —
Fields #
| Name | Description |
|---|---|
Index UInt32 | — |
AppItemCount UInt32 | — |
Event ID 2255 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2256 —
Event ID 2257 —
Event ID 2258 —
Event ID 2259 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
Event ID 2260 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
Event ID 2262 —
Event ID 2263 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2264 —
Event ID 2265 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2266 —
Event ID 2267 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2268 —
Event ID 2269 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2270 —
Event ID 2271 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2302 —
Fields #
| Name | Description |
|---|---|
ShowMethod UInt32 | — |
Event ID 2303 —
Fields #
| Name | Description |
|---|---|
ShowMethod UInt32 | — |
Event ID 2305 —
Event ID 2306 —
Event ID 2313 —
Event ID 2314 —
Event ID 2315 —
Fields #
| Name | Description |
|---|---|
ViewFromGuid UnicodeString | — |
ViewToGuid UnicodeString | — |
Event ID 2316 —
Event ID 2324 —
Event ID 2325 —
Fields #
| Name | Description |
|---|---|
RenderedTileCount UInt32 | — |
RealizedTileCount UInt32 | — |
Event ID 2326 —
Event ID 2327 —
Fields #
| Name | Description |
|---|---|
NumOfVisibleTiles UInt32 | — |
Event ID 2335 —
Fields #
| Name | Description |
|---|---|
ScenarioId UInt32 | — |
ScenarioName UnicodeString | — |
Event ID 2336 —
Fields #
| Name | Description |
|---|---|
ScenarioId UInt32 | — |
ScenarioName UnicodeString | — |
Event ID 2356 —
Event ID 2357 —
Event ID 2361 —
Event ID 2362 —
Fields #
| Name | Description |
|---|---|
HowDismiss UInt32 | — |
Event ID 2363 —
Event ID 2364 —
Fields #
| Name | Description |
|---|---|
HowDismissed UInt32 | — |
AppName UnicodeString | — |
PackageName UnicodeString | — |
Event ID 2365 —
Event ID 2366 —
Event ID 2368 —
Event ID 2369 —
Event ID 2373 —
Event ID 2374 —
Event ID 2382 —
Event ID 2450 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 2451 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
PackageFullName UnicodeString | — |
AppUserModelId UnicodeString | — |
Packed_Hi_RequestedTimeoutExtensionMs16_Flags11_Crashed1_Throttled1_EnforceTimeout1_IsChild1_TimedOut1_Lo UInt32 | — |
Packed_Hi_ModeSwitchesToUnthrottledCount2_IoOpportunityTime100Ms10_CpuReadyTime100Ms10_CpuRunningTime100Ms10_Lo UInt32 | — |
Event ID 2453 —
Event ID 2454 —
Event ID 2463 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 2464 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
PackageFullName UnicodeString | — |
AppUserModelId UnicodeString | — |
PackedResumeDurationsMs_HiWordAppLoWordPackage UInt32 | — |
Flags UInt32 | — |
Event ID 2468 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Reason UInt32 | — |
HiFlags_LoAppCount UInt32 | — |
HiThreshold_LoCurrentMetric UInt32 | — |
SumOfPrivateWsOrSumOfSwapUsageOrPrivateModifiedSize UInt32 | — |
Event ID 2472 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
ResumeReason UInt32 | — |
Event ID 2473 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
OldState UInt32 | — |
NewState UInt32 | — |
Event ID 2474 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
UserRequest UInt32 | — |
ExecutionRequest UInt32 | — |
KernelRequest UInt32 | — |
Event ID 2480 —
Fields #
| Name | Description |
|---|---|
AppUserModelId UnicodeString | — |
Flags UInt32 | — |
Event ID 2481 —
Fields #
| Name | Description |
|---|---|
AppUserModelId UnicodeString | — |
PendingTaskCompletions UInt32 | — |
DeferredTerminate Boolean | — |
Result UInt32 | — |
Event ID 2482 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 2483 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 2484 — Package PsmKey was terminated because it took too long to suspend.
Event ID 2485 — Package {PsmKey} was terminated due to low system resources.
Event ID 2486 — App PsmKey did not launch within its allotted time.
Event ID 2491 —
Fields #
| Name | Description |
|---|---|
TaskCompletionType UInt32 | — |
PackageFullName UnicodeString | — |
Event ID 2492 —
Fields #
| Name | Description |
|---|---|
TaskCompletionType UInt32 | — |
PackageFullName UnicodeString | — |
Event ID 2493 —
Event ID 2494 —
Event ID 2495 —
Fields #
| Name | Description |
|---|---|
PresentNonBlockingTaskCompletions UInt32 | — |
Event ID 2499 —
Fields #
| Name | Description |
|---|---|
Wakes UInt32 | — |
PsmKey UnicodeString | — |
Event ID 2500 —
Event ID 2501 —
Event ID 2504 —
Event ID 2601 —
Event ID 2602 —
Event ID 2607 —
Event ID 2608 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2609 —
Event ID 2611 —
Event ID 2612 —
Event ID 2614 —
Event ID 2615 —
Event ID 2617 —
Event ID 2618 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2619 —
Event ID 2625 —
Event ID 2626 —
Event ID 2631 —
Event ID 2632 —
Event ID 2634 —
Event ID 2635 —
Event ID 2667 —
Event ID 2671 —
Fields #
| Name | Description |
|---|---|
CommandId UnicodeString | — |
Event ID 2679 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2680 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2682 —
Event ID 2683 —
Event ID 2685 —
Event ID 2686 —
Event ID 2688 —
Event ID 2690 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 2691 —
Event ID 2692 —
Event ID 2694 —
Event ID 2695 —
Event ID 2801 — The template requested by a tile notification has failed to parse.
Description
The template requested by a tile notification has failed to parse.
Message #
Event ID 2802 — The template requested by a tile notification does not exist.
Description
The template requested by a tile notification does not exist.
Message #
Event ID 2803 — The content of a tile notification does not match the chosen template.
Description
The content of a tile notification does not match the chosen template.
Message #
Event ID 2806 —
Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | — |
ActivationParameters UnicodeString | — |
Event ID 2820 — A new notification has arrived for a tile.
Description
A new notification has arrived for a tile.
Message #
Event ID 2823 — The image could not be loaded because it is not a PNG or JPEG
Event ID 2824 — The image could not be loaded because it is too large
Event ID 2825 — The image could not be loaded because the provided path does not exist
Event ID 2826 — The image that was loaded is incorrect given the current DPI and/or theme
Description
The image that was loaded is incorrect given the current DPI and/or theme.
Message #
Event ID 2827 — The image could not be loaded because the protocol handler used is invalid
Event ID 2828 — A notification for this tile expired while it was visible
Description
A notification for this tile expired while it was visible.
Message #
Event ID 2829 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
NotificationID UInt32 | — |
Event ID 2836 —
Event ID 2838 — The processing of a tile notification has failed.
Description
The processing of a tile notification has failed.
Message #
Event ID 2839 — A tile notification has been marked as known bad and will never be processed again.
Description
A tile notification has been marked as known bad and will never be processed again.
Message #
Event ID 2850 — A tile has attempted to load an image off disk.
Event ID 2924 —
Event ID 2930 —
Event ID 3000 — Failed to register for licensing policy change event.
Event ID 3001 — Failed to create the watermark window.
Event ID 3002 — Failed to load the genuine licensing image.
Event ID 3003 — Failed to blend the genuine licensing image.
Event ID 3004 — Failed to render the watermark.
Event ID 3005 — Failed to get genuine status.
Event ID 3101 —
Event ID 3102 —
Event ID 3103 —
Event ID 3104 —
Event ID 3105 —
Event ID 3106 —
Event ID 3107 —
Event ID 3108 —
Event ID 3111 —
Event ID 3112 —
Event ID 3113 —
Event ID 3114 —
Event ID 3150 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
Event ID 3151 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
Event ID 3152 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
DeviceHardwareID UnicodeString | — |
Manufacturer UnicodeString | — |
ModelName UnicodeString | — |
PrimaryCategory UnicodeString | — |
Event ID 3153 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
DeviceHardwareID UnicodeString | — |
Manufacturer UnicodeString | — |
ModelName UnicodeString | — |
PrimaryCategory UnicodeString | — |
Event ID 3154 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
DeviceHardwareID UnicodeString | — |
Manufacturer UnicodeString | — |
ModelName UnicodeString | — |
PrimaryCategory UnicodeString | — |
Event ID 3155 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
DeviceHardwareID UnicodeString | — |
Manufacturer UnicodeString | — |
ModelName UnicodeString | — |
PrimaryCategory UnicodeString | — |
Event ID 3156 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
DeviceHardwareID UnicodeString | — |
Manufacturer UnicodeString | — |
ModelName UnicodeString | — |
PrimaryCategory UnicodeString | — |
Event ID 3157 —
Fields #
| Name | Description |
|---|---|
Duration UInt32 | — |
DeviceHardwareID UnicodeString | — |
Manufacturer UnicodeString | — |
ModelName UnicodeString | — |
PrimaryCategory UnicodeString | — |
Event ID 3200 —
Fields #
| Name | Description |
|---|---|
EdgeUiComponent UInt32 | — |
Event ID 3201 —
Event ID 3202 —
Event ID 3203 —
Fields #
| Name | Description |
|---|---|
EdgeUiComponent UInt32 | — |
Event ID 3204 —
Fields #
| Name | Description |
|---|---|
EdgeUiComponent UInt32 | — |
Event ID 3205 —
Fields #
| Name | Description |
|---|---|
EdgeUiComponent UInt32 | — |
Event ID 3206 —
Event ID 4007 —
Event ID 4008 —
Event ID 4015 — Windows.
Event ID 4016 — Windows.
Description
Windows.System.Launcher.LaunchFileAsync failed because the launched file has no file extension.
Message #
Event ID 4017 — Windows.
Description
Windows.System.Launcher.LaunchFileAsync failed because the current group policy settings prohibit launching desktop programs through this API.
Message #
Event ID 4018 — Windows.
Event ID 4019 — Windows.
Description
Windows.System.Launcher.LaunchUriAsync failed because the current group policy settings prohibit launching desktop programs through this API.
Message #
Event ID 4020 — Windows.
Event ID 4021 — Windows.
Description
Windows.System.Launcher.LaunchUriAsync failed because file URI has no file extension.
Message #
Event ID 4022 — Windows.
Event ID 4023 — Windows.
Event ID 4024 — Windows.
Event ID 4300 — The Monitor Manager is adding a new display with identity {MonitorIdentity}.
Event ID 4301 — The Monitor Manager is adding a new display with identity {MonitorIdentity}.
Event ID 4302 — The Monitor Manager is adding a new display with identity MonitorIdentity.
Event ID 4303 — The Monitor Manager is adding a new display with identity {MonitorIdentity}.
Event ID 4312 — The Monitor Manager is handling a display change notification.
Event ID 4313 — The Monitor Manager is handling a display change notification.
Event ID 4314 — The Monitor Manager is handling a display change notification.
Description
The Monitor Manager is handling a display change notification.
Message #
Event ID 4315 — The Monitor Manager is handling a display change notification.
Description
The Monitor Manager is handling a display change notification.
Message #
Event ID 4316 — An object is being connected to the Monitor MonitorIdentity.
Event ID 4317 — An object is being connected to the Monitor MonitorIdentity.
Event ID 4318 — The Monitor manager is reconciling monitors
Description
The Monitor manager is reconciling monitors.
Message #
Event ID 4319 — The Monitor manager is reconciling monitors
Description
The Monitor manager is reconciling monitors.
Message #
Event ID 4320 — The Monnitor Manager could not create a monitor identity.
Event ID 4325 —
Fields #
| Name | Description |
|---|---|
MonitorIdentity UInt32 | — |
HMonitor Pointer | — |
Left UInt32 | — |
Top UInt32 | — |
Event ID 4326 —
Fields #
| Name | Description |
|---|---|
MonitorIdentity UInt32 | — |
HMonitor Pointer | — |
Left UInt32 | — |
Top UInt32 | — |
Event ID 4636 — The tile cache has run out of room in its header.
Description
The tile cache has run out of room in its header.
Message #
Event ID 4637 — The tile cache cannot expand because the hard disk is full.
Description
The tile cache cannot expand because the hard disk is full.
Message #
Event ID 4668 — The tile cache has suffered a CRC failure for this entry's data region.
Event ID 4669 — The tile cache has suffered a CRC failure for this entry's entry/header region.
Event ID 4672 — A reordering of the tile cache file has failed.
Description
A reordering of the tile cache file has failed.
Message #
Event ID 4673 — A reordering of the tile logo cache file has failed.
Description
A reordering of the tile logo cache file has failed.
Message #
Event ID 4676 — The Optimize Start menu cache files task has been requested due to a layout change.
Description
The Optimize Start menu cache files task has been requested due to a layout change.
Message #
Event ID 4677 — Failed to remap the cache.
Event ID 5901 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
PackageMoniker UnicodeString | — |
SqmableContractID UnicodeString | — |
ExeName UnicodeString | — |
PreviousExecutionState UInt32 | — |
Opportunistic UInt32 | — |
Event ID 5902 —
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | — |
PackageMoniker UnicodeString | — |
SqmableContractID UnicodeString | — |
ExeName UnicodeString | — |
PreviousExecutionState UInt32 | — |
Opportunistic UInt32 | — |
Event ID 5903 —
Event ID 5904 —
Event ID 5905 —
Event ID 5906 —
Event ID 5907 —
Fields #
| Name | Description |
|---|---|
ActivationOptions UInt32 | — |
Event ID 5908 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 5909 —
Fields #
| Name | Description |
|---|---|
AppClosed Boolean | — |
Event ID 5911 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 5913 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 5915 —
Event ID 5917 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 5919 —
Fields #
| Name | Description |
|---|---|
PackageActivationSettings UInt32 | — |
Event ID 5921 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
ErrorCode UInt32 | — |
DialogId GUID | — |
Event ID 5922 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
ErrorCode UInt32 | — |
DialogId GUID | — |
DismissMethod UInt32 | — |
Event ID 5924 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
TimeOutPeriod UInt32 | — |
Event ID 5925 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 5926 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 5927 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 5928 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
WaitSignal UInt32 | — |
Event ID 5929 —
Event ID 5930 —
Event ID 5950 — The app AppId was activated for the ContractId contract successfully.
Event ID 5951 — The app AppId is not registered for the ContractId contract or is not installed.
Event ID 5952 — The app AppId has more than one extension registered for the ContractId contract.
Event ID 5953 — The app AppId's package family (ContractId) has more than one package installed.
Event ID 5954 — The app AppId could not be activated for the ContractId contract because UAC is disabled.
Event ID 5955 — The app AppId could not be activated for the ContractId contract because the current user is an Administrator with a full token.
Event ID 5956 — Activation of the app AppId for the ContractId contract was blocked because the activation attempt occurred in an elevated context.
Event ID 5957 — The app {AppId} could not be activated for the {ContractId} contract because the current screen resolution is below 1024x768.
Event ID 5958 — The app AppId could not be activated for the ContractId contract because Desktop Composition is disabled.
Event ID 5959 — Activation of the app AppId for the ContractId contract timed out.
Event ID 5960 — Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because its package is in state: PackageState.
Event ID 5961 — Activation for AppId failed.
#Description
Activation for AppId failed. Error code: ErrorCode. Activation phase: PhaseFlags.
Message #
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
ErrorCode Int32 | 1 failed. Error code. |
PhaseFlags UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "315A8872-923E-4EA2-9889-33CD4754BF64",
"event_source_name": "",
"event_id": 5961,
"version": 0,
"level": 2,
"task": 5961,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2023-10-25T22:11:30.700709+00:00",
"event_record_id": 5,
"correlation": {
"ActivityID": "028F2288-078F-0000-DBA0-8F028F07DA01"
},
"execution": {
"process_id": 4820,
"thread_id": 4516
},
"channel": "Microsoft-Windows-TWinUI/Operational",
"computer": "WinDevEval",
"security": {
"user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
}
},
"event_data": {
"AppId": "Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App",
"ErrorCode": -2144927141,
"PhaseFlags": 34
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5962 — Activation of the app failed with error: ErrorCode.
Event ID 5963 — Activation of the app AppId for the ContractId contract was blocked by policy.
Event ID 5964 — The app AppId could not be activated for the ContractId contract because the app manager is not running.
Event ID 5965 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
ContractId UnicodeString | — |
ErrorCode UInt32 | — |
Event ID 5966 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
ContractId UnicodeString | — |
ErrorCode UInt32 | — |
Event ID 5967 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
ContractId UnicodeString | — |
ProcessId UInt32 | — |
Event ID 5970 — Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because of an issue with application binary FailedBinary.
Event ID 5971 — Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because of an issue with Windows binary FailedBinary.
Event ID 5972 — Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because of an issue with binary FailedBinary.
Event ID 5973 — Activation of app AppId failed with error: ErrorCode See the Microsoft-Windows-TWinUI/Operational log for additional information.
Event ID 5974 — Activation of the app AppId for the ContractId contract was blocked because of a temporary issue with its license.
Event ID 5975 — Activation of the app AppId for the ContractId contract was blocked because its package is being updated.
Event ID 5976 — Activation of the app AppId for the ContractId contract was blocked because its trial license has expired.
Event ID 5977 —
Fields #
| Name | Description |
|---|---|
Reserved UInt32 | — |
MatchKey UnicodeString | — |
Event ID 5978 —
Fields #
| Name | Description |
|---|---|
aamActivationId UInt64 | — |
AppId UnicodeString | — |
MatchKey UnicodeString | — |
Event ID 5979 —
Fields #
| Name | Description |
|---|---|
Reserved UInt32 | — |
MatchKey UnicodeString | — |
Event ID 5980 —
Fields #
| Name | Description |
|---|---|
Reserved UInt32 | — |
MatchKey UnicodeString | — |
Event ID 5981 —
Fields #
| Name | Description |
|---|---|
Reserved UInt32 | — |
ViewId UInt32 | — |
Event ID 5982 —
Fields #
| Name | Description |
|---|---|
Reserved UInt32 | — |
ViewId UInt32 | — |
Event ID 5983 — Activation of the app AppId for the ContractId contract failed during verifcation and initialization with ErrorCode.
Event ID 5984 — Activation of the app AppId for the ContractId contract failed during activation initialization with ErrorCode.
Event ID 5985 — ActivateApplicationForContractByAppIdAsUserWithHost of the app AppId for the ContractId contract failed with ErrorCode.
Event ID 5986 — ActivateApplicationForContractByExtensionIdAsUserWithHost of the app AppId for the ContractId contract failed with ErrorCode.
Event ID 5987 — ActivateApplicationForContractByAppIdAsUserWithHostReturnsApp of the app AppId for the ContractId contract failed with ErrorCode.
Event ID 5988 — ActivateApplicationForContractByAcidAsUserWithHost of the app AppId for the ContractId contract failed with ErrorCode.
Event ID 5989 — ActivateApplicationForComponentUIByAUMID of the app AppId for the ContractId contract failed with ErrorCode.
Event ID 5990 — Activation via contract helper of the app AppId for the ContractId contract failed with ErrorCode.
Event ID 6200 — Docking Service: GetAvailable called.
Description
Docking Service: GetAvailable called.
Message #
Event ID 6201 — Docking Service: GetAvailable called.
Description
Docking Service: GetAvailable called.
Message #
Event ID 6202 — Docking Service: ReserveDockingSpace called.
Description
Docking Service: ReserveDockingSpace called.
Message #
Event ID 6203 — Docking Service: ReserveDockingSpace called.
Description
Docking Service: ReserveDockingSpace called.
Message #
Event ID 6204 — Docking Service: DockWindow called.
Description
Docking Service: DockWindow called.
Message #
Event ID 6205 — Docking Service: DockWindow called.
Description
Docking Service: DockWindow called.
Message #
Event ID 6206 — Docking Service: UndockWindow called.
Description
Docking Service: UndockWindow called.
Message #
Event ID 6207 — Docking Service: UndockWindow called.
Description
Docking Service: UndockWindow called.
Message #
Event ID 6208 — Docking Service: Handling work area / resolution changes.
Description
Docking Service: Handling work area / resolution changes.
Message #
Event ID 6209 — Docking Service: Handling work area / resolution changes.
Description
Docking Service: Handling work area / resolution changes.
Message #
Event ID 6252 —
Fields #
| Name | Description |
|---|---|
FilePath UnicodeString | — |
Event ID 6253 —
Event ID 6256 —
Event ID 6257 —
Event ID 6400 —
Event ID 6401 —
Event ID 6402 —
Event ID 6403 —
Event ID 6404 —
Event ID 6405 —
Event ID 6406 —
Event ID 6407 —
Event ID 6408 —
Event ID 6409 —
Event ID 6410 —
Event ID 6411 —
Event ID 6412 —
Event ID 6413 —
Event ID 6501 — Setting for AppId: AppUserModelID has been changed to SettingValue from Permissions View.
Event ID 6502 — Setting for AppId: AppUserModelID has enabled = SettingValue in Permissions View.
Event ID 6503 — Setting for AppId: AppUserModelID is supported in Permissions View?
Event ID 6505 — Global Toast Setting has changed to {SettingValue} from setting flyout.
Event ID 6506 — Setting Sync Scheduled for Package: PackageFamilyName on behalf of AppUserModelId: AppUserModelID.
Event ID 6510 — User Session Toast Manager has sent Display Message to Lock Screen for Notification Id: {NotificationId}.
Event ID 6511 — User Session Toast Manager has sent Cancel Message to Lock Screen for Notification Id: {NotificationId}.
Event ID 6512 — User Session Toast Manager has received Activate Message from Lock Screen for Notification Id: {NotificationId}.
Event ID 6513 — User Session Toast Manager has received Dismiss Message from Lock Screen for Notification Id: {NotificationId} Is Decayed?
Event ID 6514 — User Session Toast Manager has received Pause Message from Lock Screen for Notification Id: {NotificationId}.
Event ID 6515 — User Session Toast Manager has received Selection Message from Lock Screen for Notification Id: {NotificationId} IsSelected?
Event ID 6516 — User Session Toast Manager has received Frozen Message from Lock Screen.
Event ID 6521 — Lock Screen Toast Manager has received a display toast message for Notification Id: {NotificationId} Is Long Duration?
Event ID 6522 — Lock Screen Toast Manager has received a cancel message for Notification Id: {NotificationId}.
Event ID 6523 — Lock Screen Toast Manager has received frozen message from Lock Screen.
Event ID 6525 — Lock Screen Toast Manager has sent selection message to Lock Screen for Notification Id: {NotificationId} Is Selected?
Event ID 6526 — Lock Screen Toast Manager has sent dismissed message to Lock Screen for Notification Id: {NotificationId}.
Event ID 6527 — Lock Screen Toast Manager has sent pause message to Lock Screen for Notification Id: {NotificationId}.
Event ID 6529 — Notifications Settings Charm Widget has closed its context menu with result {MenuOption}.
Event ID 6530 — Notifications Settings Charm Widget has updated its UI to state {MenuOption}.
Event ID 6531 — Toast Dropped due to Quiet Hours.
Event ID 6601 —
Fields #
| Name | Description |
|---|---|
SessionID UInt32 | — |
DeviceInstanceID UnicodeString | — |
Event ID 6606 —
Fields #
| Name | Description |
|---|---|
DeviceCount UInt32 | — |
Event ID 6607 —
Fields #
| Name | Description |
|---|---|
DeviceCount UInt32 | — |
Event ID 6611 —
Fields #
| Name | Description |
|---|---|
DeviceInstanceID UnicodeString | — |
Event ID 6612 —
Fields #
| Name | Description |
|---|---|
DeviceInstanceID UnicodeString | — |
Connected Boolean | — |
Event ID 6616 —
Fields #
| Name | Description |
|---|---|
DeviceCount UInt32 | — |
Event ID 6617 —
Fields #
| Name | Description |
|---|---|
DeviceCount UInt32 | — |
Event ID 6621 —
Event ID 6622 —
Event ID 6631 —
Event ID 6632 —
Fields #
| Name | Description |
|---|---|
ContentType UInt32 | — |
Event ID 6636 —
Event ID 6637 —
Event ID 6641 —
Fields #
| Name | Description |
|---|---|
Count UInt32 | — |
Event ID 6642 —
Fields #
| Name | Description |
|---|---|
Count UInt32 | — |
Event ID 6644 —
Event ID 6645 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 6647 —
Event ID 6648 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 6650 —
Event ID 6651 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 6653 —
Event ID 6654 —
Event ID 6690 — The request for a Print Task timed out for application AppId.
Event ID 6691 — The request for a Play Source timed out for application AppId.
Event ID 6714 —
Fields #
| Name | Description |
|---|---|
ApiType UInt32 | — |
Event ID 6715 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 6716 —
Fields #
| Name | Description |
|---|---|
ApiType UInt32 | — |
Event ID 6718 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 6720 —
Event ID 6721 —
Event ID 6722 —
Fields #
| Name | Description |
|---|---|
NumApp UInt32 | — |
SetDefault Boolean | — |
Event ID 6723 —
Event ID 6820 —
Event ID 6821 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 6822 —
Event ID 6823 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 6824 —
Event ID 6825 —
Event ID 6826 —
Event ID 6827 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 6828 —
Event ID 6841 —
Fields #
| Name | Description |
|---|---|
ApiType UInt32 | — |
Event ID 6844 —
Event ID 6845 —
Event ID 6850 — Checking secondary tile roaming quota.
Description
Checking secondary tile roaming quota.
Message #
Event ID 6851 — Finished checking secondary tile roaming quota with HRESULT HRESULT, quota Quota bytes, current usage CurrentUsage bytes.
Event ID 6852 — Enforcing secondary tile roaming quota - need to reduce BytesToReduce bytes.
Event ID 6853 — Finished enforcing secondary tile roaming quota with HRESULT HRESULT, reclaimed BytesReclaimed bytes.
Event ID 6854 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Path UnicodeString | — |
Size UInt32 | — |
Visible Boolean | — |
Event ID 6855 —
Fields #
| Name | Description |
|---|---|
NumOrphanFiles UInt32 | — |
Event ID 6856 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
BytesReclaimed UInt32 | — |
Event ID 6857 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Path UnicodeString | — |
Size UInt32 | — |
Visible Boolean | — |
Event ID 7039 —
Event ID 7040 —
Fields #
| Name | Description |
|---|---|
RenderedTileCount UInt32 | — |
RealizedTileCount UInt32 | — |
Event ID 7130 —
Event ID 7131 —
Event ID 7150 — Entering SetUseConnectedSearch API.
Description
Entering SetUseConnectedSearch API.
Message #
Event ID 7151 — Entering SetLocationAwareness API.
Description
Entering SetLocationAwareness API.
Message #
Event ID 7152 — Entering SetSafeSearch API.
Description
Entering SetSafeSearch API.
Message #
Event ID 7153 — Entering DeleteOnlineSearchHistory API.
Description
Entering DeleteOnlineSearchHistory API.
Message #
Event ID 7154 — Entering DeleteLocalSearchHistory API.
Description
Entering DeleteLocalSearchHistory API.
Message #
Event ID 7155 — Exiting DeleteOnlineHistory API - HRESULT: 0xErrorResult.
Event ID 7156 — Exiting DeleteLocalHistory API - HRESULT: 0xErrorResult.
Event ID 7157 — Exiting SetUseConnectedSearch API - ChangeTo: ChangeTo.
Event ID 7158 — Exiting SetLocationAwareness API - ChangeTo: ChangeTo.
Event ID 7159 — Exiting SetSafeSearch API - ChangeTo: ChangeTo.
Event ID 7160 — Entering LogDetailArrowClick API call.
Description
Entering LogDetailArrowClick API call.
Message #
Event ID 7161 — Exiting LogDetailArrowClick API call.
Event ID 7162 — Entering LogDetailArrowClick background worker.
Description
Entering LogDetailArrowClick background worker.
Message #
Event ID 7163 — Exiting LogDetailArrowClick background worker.
Description
Exiting LogDetailArrowClick background worker.
Message #
Event ID 7164 — Entering LogAttributionClick API call.
Description
Entering LogAttributionClick API call.
Message #
Event ID 7165 — Exiting LogAttributionClick API call.
Event ID 7166 — Entering LogAttributionClick background worker.
Description
Entering LogAttributionClick background worker.
Message #
Event ID 7167 — Exiting LogAttributionClick background worker.
Description
Exiting LogAttributionClick background worker.
Message #
Event ID 7168 — Detail Arrow Click Properties JSON Payload serialized - Payload: JSON.
Event ID 7169 — Attribution Click Properties JSON Payload serialized - Payload: JSON.
Event ID 7170 — Details Visibility JSON Payload serialized - Payload: JSON.
Event ID 7171 — Attribution Visibility JSON Payload serialized - Payload: JSON.
Event ID 7172 — App Bar Click JSON Payload serialized - Payload: JSON.
Event ID 7173 — Detail Arrow Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Telemetry Id: TargetId, Arrow Direction: ArrowDirection.
Event ID 7174 — Detail View Visibility Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, IsVisible?
Event ID 7175 — Attribution Overlay Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Telemetry Id: TargetId.
Event ID 7176 — Attribution Overlay Visibility Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, IsVisible?
Event ID 7177 — App Bar Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Telemetry Id: TargetId, Command Id: CommandId.
Event ID 7178 — Entering LogDetailsViewVisibility API call.
Description
Entering LogDetailsViewVisibility API call.
Message #
Event ID 7179 — Exiting LogDetailsViewVisibility API call.
Event ID 7180 — Entering LogDetailsViewVisibility background worker.
Description
Entering LogDetailsViewVisibility background worker.
Message #
Event ID 7181 — Exiting LogDetailsViewVisibility background worker.
Description
Exiting LogDetailsViewVisibility background worker.
Message #
Event ID 7182 — Entering LogAttributionVisibility API call.
Description
Entering LogAttributionVisibility API call.
Message #
Event ID 7183 — Exiting LogAttributionVisibility API call.
Event ID 7184 — Entering LogAttributionVisibility background worker.
Description
Entering LogAttributionVisibility background worker.
Message #
Event ID 7185 — Exiting LogAttributionVisibility background worker.
Description
Exiting LogAttributionVisibility background worker.
Message #
Event ID 7186 — Entering LogAppBarClick API call.
Description
Entering LogAppBarClick API call.
Message #
Event ID 7187 — Exiting LogAppBarClick API call.
Event ID 7188 — Entering LogAppBarClick background worker.
Description
Entering LogAppBarClick background worker.
Message #
Event ID 7189 — Exiting LogAppBarClick background worker.
Description
Exiting LogAppBarClick background worker.
Message #
Event ID 7190 — Local Suggestion JSON Payload serialized - Payload: JSON.
Event ID 7191 — Perf Ping JSON Payload serialized - Payload: JSON.
Event ID 7192 — Entering GetInstrumenationForDirectQuery API call.
Description
Entering GetInstrumenationForDirectQuery API call.
Message #
Event ID 7193 — Exiting GetInstrumenationForDirectQuery API call.
Event ID 7194 — Direct Query Instrumentation Processing Complete - Error Code: Result, Partial Query: PartialQuery, Number of Suggestions Shown: SelectedPosition, Max Query Length With Sugges...
Description
Direct Query Instrumentation Processing Complete - Error Code: Result, Partial Query: PartialQuery, Number of Suggestions Shown: SelectedPosition, Max Query Length With Suggestion: MaxQueryLengthWithSuggestion, Instrumentation Payload: Payload.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
PartialQuery UnicodeString | — |
SelectedPosition UInt32 | — |
MaxQueryLengthWithSuggestion UInt32 | — |
Payload UnicodeString | — |
Event ID 7195 — Entering LogParsingError API call.
Description
Entering LogParsingError API call.
Message #
Event ID 7196 — Exiting LogParsingError API call.
Event ID 7197 — Entering LogParsingError background worker.
Description
Entering LogParsingError background worker.
Message #
Event ID 7198 — Exiting LogParsingError background worker.
Description
Exiting LogParsingError background worker.
Message #
Event ID 7199 — Parsing Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Url: Url, Error HBT: HBT.
Description
Parsing Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Url: Url, Error HBT: HBT.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
ErrorCode UInt32 | — |
Url UnicodeString | — |
HBT UnicodeString | — |
Event ID 7200 — Active Impression GUID has been set - Operation Error Code: Result, Impression GUID: ImpressionGUID.
Event ID 7202 —
Event ID 7203 —
Event ID 7204 — Instrumentation Payload dropped because Impression Guid was not set - Dropped Instrumentation API: DroppedAPIcall.
Event ID 7205 — Entering LogWebResultClick API call.
Description
Entering LogWebResultClick API call.
Message #
Event ID 7206 — Exiting LogWebResultClick API call.
Event ID 7207 — Entering LogWebResultClick background worker.
Description
Entering LogWebResultClick background worker.
Message #
Event ID 7208 — Exiting LogWebResultClick background worker.
Description
Exiting LogWebResultClick background worker.
Message #
Event ID 7209 — Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Target ID: TargetId, Input Method: InputMethod, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewpo...
Description
Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Target ID: TargetId, Input Method: InputMethod, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewport Flags: ViewportFlags.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
TargetId UnicodeString | — |
InputMethod UInt32 | — |
FirstItemId UnicodeString | — |
LastItemId UnicodeString | — |
ViewportFlags UInt32 | — |
Event ID 7210 — Click Event JSON Serialization Complete - Input Method: InputMethod, Timestamp: ViewMode, IsLandscape: Timestamp, JSON: JSON.
Event ID 7211 — Instrumentation Event Enqueued for Upload - Impression GUID: ImpressionGUID, Timestamp: Timestamp, HRESULT: ErrorCode, Url: Url, HBT: HBT.
Event ID 7212 — Instrumentation Event Dequeued for Upload - Impression GUID: ImpressionGUID, Timestamp: Timestamp, JSON: JSON.
Event ID 7213 — Instrumentation Payload uploaded - POST Payload: Body, Query String: QueryString Error Code: Result.
Event ID 7214 — Connection Established to Instrumentation Endpoint - Endpoint Id: EndpointCode, Host Name: Hostname, Object Name: ObjectName, User Agent: UserAgent.
Event ID 7215 — Upload Request sent to Instrumentation Endpoint - HTTP Response Code: HTTPResponseCode, HTTP Request Headers: HTTPHeaders, HTTP Post Payload: HTTPPostPayload.
Event ID 7216 — Authentication has started
Description
Authentication has started.
Message #
Event ID 7217 — Authentication has stopped
Description
Authentication has stopped.
Message #
Event ID 7218 — Authentication has succeeded
Description
Authentication has succeeded.
Message #
Event ID 7219 — Authentication failed - Error Code: 0xErrorResult.
Event ID 7221 — HTTP Request failed - Error Code: 0xErrorResult.
Event ID 7222 — Entering LogLocalResultClick API call.
Description
Entering LogLocalResultClick API call.
Message #
Event ID 7223 — Exiting LogLocalResultClick API call.
Event ID 7224 — Entering LogLocalResultClick background worker.
Description
Entering LogLocalResultClick background worker.
Message #
Event ID 7225 — Exiting LogLocalResultClick background worker.
Description
Exiting LogLocalResultClick background worker.
Message #
Event ID 7226 — Entering LogScroll API call.
Description
Entering LogScroll API call.
Message #
Event ID 7227 — Exiting LogScroll API call.
Event ID 7228 — Entering LogScroll background worker.
Description
Entering LogScroll background worker.
Message #
Event ID 7229 — Exiting LogScroll background worker.
Description
Exiting LogScroll background worker.
Message #
Event ID 7232 — Entering LogWebLayoutChange API call.
Description
Entering LogWebLayoutChange API call.
Message #
Event ID 7233 — Exiting LogWebLayoutChange API call.
Event ID 7234 — Entering LogWebLayoutChange background worker.
Description
Entering LogWebLayoutChange background worker.
Message #
Event ID 7235 — Exiting LogWebLayoutChange background worker.
Description
Exiting LogWebLayoutChange background worker.
Message #
Event ID 7236 — Entering LogLocalLayoutChange API call.
Description
Entering LogLocalLayoutChange API call.
Message #
Event ID 7237 — Exiting LogLocalLayoutChange API call.
Event ID 7238 — Entering LogLocalLayoutChange background worker.
Description
Entering LogLocalLayoutChange background worker.
Message #
Event ID 7239 — Exiting LogLocalLayoutChange background worker.
Description
Exiting LogLocalLayoutChange background worker.
Message #
Event ID 7241 — Entering LogAppVisibilityChange API call.
Description
Entering LogAppVisibilityChange API call.
Message #
Event ID 7242 — Exiting LogAppVisibilityChange API call.
Event ID 7243 — Entering LogAppVisibilityChange background worker.
Description
Entering LogAppVisibilityChange background worker.
Message #
Event ID 7244 — Exiting LogAppVisibilityChange background worker.
Description
Exiting LogAppVisibilityChange background worker.
Message #
Event ID 7245 — Entering LogAppResize API call.
Description
Entering LogAppResize API call.
Message #
Event ID 7246 — Exiting LogAppResize API call.
Event ID 7247 — Entering LogAppResize background worker.
Description
Entering LogAppResize background worker.
Message #
Event ID 7248 — Exiting LogAppResizeChange background worker.
Description
Exiting LogAppResizeChange background worker.
Message #
Event ID 7249 — Scroll Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Scroll Direction: ScrollDirection, Input Method: InputMethod, First Item ID: FirstItemId, Last Item ID: LastI...
Description
Scroll Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Scroll Direction: ScrollDirection, Input Method: InputMethod, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewport Flags: ViewportFlags.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
ScrollDirection UInt32 | — |
InputMethod UInt32 | — |
FirstItemId UnicodeString | — |
LastItemId UnicodeString | — |
ViewportFlags UInt32 | — |
Event ID 7250 — App Visibility Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, New Visibility State: NewVisibilityState.
Event ID 7251 — App Resize Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Orientation: Orientation, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewport Flags: ViewportF...
Description
App Resize Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Orientation: Orientation, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewport Flags: ViewportFlags.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
Orientation UInt32 | — |
FirstItemId UnicodeString | — |
LastItemId UnicodeString | — |
ViewportFlags UInt32 | — |
Event ID 7252 — Web Layout Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Layout Action: LayoutAction, Telemetry Id affected: TelemetryId.
Event ID 7253 — Local Layout Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Layout Action: LayoutAction, Item Type: ResultType.
Event ID 7254 — CI.
Event ID 7255 — CI.
Event ID 7256 — CI.
Event ID 7257 — L.
Event ID 7258 — UnAuthentication has started
Description
UnAuthentication has started.
Message #
Event ID 7259 — UnAuthentication has stopped
Description
UnAuthentication has stopped.
Message #
Event ID 7261 — UnAuthentication failed - Error Code: 0xErrorResult.
Event ID 7262 — UnAuthentication has succeeded: all cookies are cleared
Description
UnAuthentication has succeeded: all cookies are cleared.
Message #
Event ID 7263 — Authentication failed in getting the token- Error Code: 0xErrorResult.
Event ID 7264 — Entering LogHttpError API call.
Description
Entering LogHttpError API call.
Message #
Event ID 7265 — Exiting LogHttpError API call.
Event ID 7266 — Entering LogHttpError background worker.
Description
Entering LogHttpError background worker.
Message #
Event ID 7267 — Exiting LogHttpError background worker.
Description
Exiting LogHttpError background worker.
Message #
Event ID 7268 — HTTP Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Url: Url, Error HBT: HBT.
Description
HTTP Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Url: Url, Error HBT: HBT.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
ErrorCode UInt32 | — |
Url UnicodeString | — |
HBT UnicodeString | — |
Event ID 7270 — Entering LogSuggestion API call.
Description
Entering LogSuggestion API call.
Message #
Event ID 7271 — Exiting LogSuggestion API call.
Event ID 7272 — Entering LogSuggestion background worker.
Description
Entering LogSuggestion background worker.
Message #
Event ID 7273 — Exiting LogSuggestion background worker.
Description
Exiting LogSuggestion background worker.
Message #
Event ID 7274 — Suggestion Event Processing Complete - Error Code: Result, Partial Query: PartialQuery, Selected Position: SelectedPosition, Max Query Length With Suggestion: MaxQueryLengthWithSuggestion, Instrume...
Description
Suggestion Event Processing Complete - Error Code: Result, Partial Query: PartialQuery, Selected Position: SelectedPosition, Max Query Length With Suggestion: MaxQueryLengthWithSuggestion, Instrumentation Payload: Payload.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
PartialQuery UnicodeString | — |
SelectedPosition UInt32 | — |
MaxQueryLengthWithSuggestion UInt32 | — |
Payload UnicodeString | — |
Event ID 7276 — CI.
Event ID 7277 — Entering LogPerfPing API call.
Description
Entering LogPerfPing API call.
Message #
Event ID 7278 — Exiting LogPerfPing API call.
Event ID 7279 — Entering LogPerfPing background worker.
Description
Entering LogPerfPing background worker.
Message #
Event ID 7280 — Exiting LogPerfPing background worker.
Description
Exiting LogPerfPing background worker.
Message #
Event ID 7282 — Perf Ping Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Data Center: DataCenter, Was Abandoned?
Description
Perf Ping Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Data Center: DataCenter, Was Abandoned?: IsAbandoned. JSON Payload: JSONPayload.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
DataCenter UnicodeString | — |
IsAbandoned Boolean | — |
JSONPayload UnicodeString | — |
Event ID 7283 — Entering LogPerfRequestStart API call.
Description
Entering LogPerfRequestStart API call.
Message #
Event ID 7284 — Exiting LogPerfRequestStart API call.
Event ID 7285 — Entering LogPerfResponseReceived API call.
Description
Entering LogPerfResponseReceived API call.
Message #
Event ID 7286 — Exiting LogPerfResponseReceived API call.
Event ID 7287 — Template download starting - Query String: QueryString, Impression GUID: ImpressionGUID.
Event ID 7288 — Template download finished - Query String: QueryString, Impression GUID: ImpressionGUID, HRESULT: ErrorCode.
Event ID 7289 — Downloaded template written to disk - Template ID: TemplateId.
Event ID 7290 — Error Instrumentation Retry Timer has been scheduled
Description
Error Instrumentation Retry Timer has been scheduled.
Message #
Event ID 7291 — Error Instrumentation Retry Timer Callback has been fired
Description
Error Instrumentation Retry Timer Callback has been fired.
Message #
Event ID 7292 — Error Instrumentation Event(s) have been dropped after a maximum number of retries
Description
Error Instrumentation Event(s) have been dropped after a maximum number of retries.
Message #
Event ID 7293 — Error Instrumentation Event has been dropped due to error overflow.
Event ID 7380 —
Fields #
| Name | Description |
|---|---|
Left Int32 | — |
Top Int32 | — |
Right Int32 | — |
Bottom Int32 | — |
Event ID 7381 —
Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | — |
Event ID 7400 — Template Fallback JSON Payload serialized - Payload: JSON.
Event ID 7401 — Entering LogTemplateFallback API call.
Description
Entering LogTemplateFallback API call.
Message #
Event ID 7402 — Exiting LogTemplateFallback API call.
Event ID 7403 — Entering LogTemplateFallback background worker.
Description
Entering LogTemplateFallback background worker.
Message #
Event ID 7404 — Exiting LogTemplateFallback background worker.
Description
Exiting LogTemplateFallback background worker.
Message #
Event ID 7405 — Template Fallback Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Fallback Telemetry ID: TelemetryID.
Event ID 7406 — Entering LogTemplateError API call.
Description
Entering LogTemplateError API call.
Message #
Event ID 7407 — Exiting LogTemplateError API call.
Event ID 7408 — Entering LogTemplateError background worker.
Description
Entering LogTemplateError background worker.
Message #
Event ID 7409 — Exiting LogTemplateError background worker.
Description
Exiting LogTemplateError background worker.
Message #
Event ID 7410 — Template Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Template ID: Url, Error Telem...
Description
Template Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Template ID: Url, Error Telemetry ID: HBT.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
ErrorCode UInt32 | — |
Url UnicodeString | — |
HBT UnicodeString | — |
Event ID 7411 — Entering SetSearchOnMeteredConnection API.
Description
Entering SetSearchOnMeteredConnection API.
Message #
Event ID 7412 — Entering SetShareHistory API.
Description
Entering SetShareHistory API.
Message #
Event ID 7413 — Exiting SetSearchOnMeteredConnection API - ChangeTo: ChangeTo.
Event ID 7414 — Exiting SetShareHistory API - ChangeTo: ChangeTo.
Event ID 7415 — App Install State Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Layout Action: LayoutAction, Telemetry Id affected: TelemetryId.
Event ID 7416 — Starting Image Downloader Pre-Fetch Task for Impression GUID: ImpressionGUID.
Event ID 7417 — Completed Image Downloader Pre-Fetch Task for Impression GUID: ImpressionGUID with HRESULT: Result.
Event ID 7418 — Starting Image Downloader Deferred Pre-Fetch Task.
Description
Starting Image Downloader Deferred Pre-Fetch Task.
Message #
Event ID 7419 — Completed Image Downloader Deferred Pre-Fetch Task with HRESULT: Result.
Event ID 7420 — Starting Image Download for URL: URL.
Event ID 7421 — Completed Image Download for URL: URL with HRESULT: Result.
Event ID 7422 — Entering LogPerfRequestSent API call.
Description
Entering LogPerfRequestSent API call.
Message #
Event ID 7423 — Exiting LogPerfRequestSent API call.
Event ID 7424 — Entering LogPerfRenderComplete API call.
Description
Entering LogPerfRenderComplete API call.
Message #
Event ID 7425 — Exiting LogPerfRenderComplete API call.
Event ID 7426 — Entering LogPerfImagesComplete API call.
Description
Entering LogPerfImagesComplete API call.
Message #
Event ID 7427 — Exiting LogPerfImagesComplete API call.
Event ID 7428 — Entering LogPerfAbandoned API call.
Description
Entering LogPerfAbandoned API call.
Message #
Event ID 7429 — Exiting LogPerfAbandoned API call.
Event ID 7430 —
Event ID 7431 —
Event ID 7432 —
Fields #
| Name | Description |
|---|---|
ChangeTo UnicodeString | — |
ErrorResult UInt32 | — |
Event ID 7433 —
Event ID 7434 —
Fields #
| Name | Description |
|---|---|
JSON UnicodeString | — |
Event ID 7435 —
Event ID 7436 —
Fields #
| Name | Description |
|---|---|
ErrorResult UInt32 | — |
Event ID 7437 —
Event ID 7438 —
Event ID 7439 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
TelemetryID UnicodeString | — |
Event ID 7440 —
Fields #
| Name | Description |
|---|---|
Path UnicodeString | — |
Validation Boolean | — |
Event ID 7441 —
Fields #
| Name | Description |
|---|---|
Path UnicodeString | — |
Validation Boolean | — |
Event ID 7442 —
Fields #
| Name | Description |
|---|---|
Path UnicodeString | — |
Event ID 7443 —
Fields #
| Name | Description |
|---|---|
Path UnicodeString | — |
Event ID 7444 —
Fields #
| Name | Description |
|---|---|
Path UnicodeString | — |
Event ID 7445 —
Fields #
| Name | Description |
|---|---|
Path UnicodeString | — |
Result UInt32 | — |
Event ID 7446 —
Event ID 7447 —
Fields #
| Name | Description |
|---|---|
ErrorResult UInt32 | — |
Event ID 7448 —
Event ID 7449 —
Fields #
| Name | Description |
|---|---|
ErrorResult UInt32 | — |
Event ID 7451 —
Event ID 7452 —
Event ID 7453 —
Fields #
| Name | Description |
|---|---|
ErrorResult UInt32 | — |
Event ID 7454 —
Event ID 7455 —
Event ID 7456 —
Fields #
| Name | Description |
|---|---|
ChangeTo UInt32 | — |
ErrorResult UInt32 | — |
Event ID 7457 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
Event ID 7459 —
Event ID 7460 —
Fields #
| Name | Description |
|---|---|
Scope UnicodeString | — |
Event ID 7461 —
Fields #
| Name | Description |
|---|---|
Scope UnicodeString | — |
Event ID 7462 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
ImpressionGUID UnicodeString | — |
Event ID 7701 —
Fields #
| Name | Description |
|---|---|
ApplicationWindow Pointer | — |
PID UInt32 | — |
AppID UnicodeString | — |
PriorityForeground Boolean | — |
SystemWindow Pointer | — |
Event ID 8002 —
Event ID 8003 —
Event ID 8005 —
Event ID 8006 —
Event ID 8009 — The operation to add an appointment failed with ReportedError.
Event ID 8010 — The operation to remove an appointment failed with ReportedError.
Event ID 8011 — A desktop app or a Windows Store app that's not running in the foreground called ShowContactCard; which returned HRESULT: {HRESULT}.
Event ID 8012 — ShowContactCard: indexer query failed with HRESULT {HRESULT}.
Event ID 8013 — ShowContactCard: initializing contact card failed with HRESULT {HRESULT}.
Event ID 8014 — ShowContactCard: populating contact card failed with HRESULT {HRESULT}.
Event ID 8015 — ShowContactCard re-mapped internal failure code {HRESULT} to S_OK before it returned.
Event ID 8016 — Found a contact (ContactId = {ContactId}) with an invalid property (PropertyKey = {PropertyKey}; PropertyValue = {PropertyValue}) in the indexer.
Event ID 8023 — ContactCard failed to download and render the user thumbnail and the HRESULT is {HRESULT}.
Event ID 8024 — {NumberOfContacts} contacts are found for contact Id {ContactId}.
Event ID 8025 — Appointment action ActionType failed with HRESULT HRESULT.
Event ID 8027 — The operation to replace an appointment failed with ReportedError.
Event ID 8028 —
Event ID 8029 —
Event ID 8030 —
Event ID 8031 —
Event ID 8205 —
Fields #
| Name | Description |
|---|---|
PackageId UnicodeString | — |
ActivatableClassId UnicodeString | — |
Verb UnicodeString | — |
Event ID 8207 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
Event ID 8209 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
Event ID 8211 —
Event ID 8213 —
Event ID 8215 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
Event ID 8216 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
Event ID 8218 —
Event ID 8220 —
Event ID 8222 —
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | — |
Event ID 9950 —
Fields #
| Name | Description |
|---|---|
CallerModule UnicodeString | — |
ObjectModule UnicodeString | — |
CLSID UnicodeString | — |
Event ID 9951 —
Fields #
| Name | Description |
|---|---|
SxSModule UnicodeString | — |
CLSID UnicodeString | — |
Event ID 10000 —
Fields #
| Name | Description |
|---|---|
hWnd UInt32 | — |
Event ID 11100 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Priority UInt32 | — |
Event ID 11110 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
PackageFullName UnicodeString | — |
AppUserModelId UnicodeString | — |
Flags UInt32 | — |
TerminateReason UInt32 | — |
Event ID 11111 —
Fields #
| Name | Description |
|---|---|
NTSTATUS UInt32 | — |
Event ID 11115 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 11116 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 11118 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
Event ID 11119 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
PackageFullName UnicodeString | — |
AppUserModelId UnicodeString | — |
PackedResumeDurationsMs_HiWordAppLoWordPackage UInt32 | — |
Flags UInt32 | — |
Event ID 11120 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
ExecutionReason UInt32 | — |
Event ID 11121 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
ExecutionReason UInt32 | — |
Event ID 11122 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
ExecutionReason UInt32 | — |
Event ID 11123 —
Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | — |
HRESULT UInt32 | — |
Reason UInt32 | — |
Event ID 11201 —
Event ID 11202 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 11203 —
Event ID 11204 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 11205 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 11206 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 11207 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 11208 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 11209 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 11210 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 11211 —
Fields #
| Name | Description |
|---|---|
Result UInt32 | — |
Event ID 11212 —
Fields #
| Name | Description |
|---|---|
ProviderDisplayName UnicodeString | — |
Event ID 11213 —
Fields #
| Name | Description |
|---|---|
ProviderDisplayName UnicodeString | — |
AccountName UnicodeString | — |
Event ID 11214 —
Fields #
| Name | Description |
|---|---|
Resource UnicodeString | — |
Identity UnicodeString | — |
Event ID 11215 —
Fields #
| Name | Description |
|---|---|
CommandId UnicodeString | — |
Event ID 11301 —
Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | — |
AppID UnicodeString | — |
AppArguments UnicodeString | — |
Event ID 11302 —
Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | — |
AppID UnicodeString | — |
AppArguments UnicodeString | — |
Event ID 11303 —
Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | — |
DeadlineHigh UInt32 | — |
DeadlineLow UInt32 | — |
Event ID 11304 —
Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | — |
DeadlineHigh UInt32 | — |
DeadlineLow UInt32 | — |
Event ID 11305 —
Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | — |
AppID UnicodeString | — |
AppArguments UnicodeString | — |
AppAlreadyRunning Boolean | — |
Event ID 11306 —
Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | — |
NewHWND Pointer | — |
NewHWNDIsSplashScreen Boolean | — |
CrossFaded Boolean | — |
Event ID 11307 —
Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | — |
NewName UnicodeString | — |