Microsoft-Windows-ModernDeployment-Diagnostics-Provider
239 events across 4 channels
Event ID 100 — Autopilot policy [Message1] not found.
Description
Autopilot policy [Message1] not found.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 100,
"version": 0,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-09T18:21:02.188508+00:00",
"event_record_id": 28,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 3512
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "ZtdCorrelationId"
},
"message": ""
}
Event ID 101 — AutopilotGetPolicyDwordByName succeeded: policy name = Message1; policy value = Int1.
Event ID 102 — AutopilotGetPolicyDwordByName error: policy name = Message1; HRESULT = HRESULT.
Event ID 103 — AutopilotGetPolicyStringByName succeeded: policy name = Message1; policy value = Message2.
Event ID 104 — AutopilotGetPolicyStringByName error: policy name = Message1; HRESULT = HRESULT.
Event ID 105 — AutopilotDisable succeeded.
Description
AutopilotDisable succeeded.
Message #
Event ID 106 — AutopilotDisable error: HRESULT = HRESULT.
Event ID 107 — Autopilot state = Message1.
Event ID 108 — AutopilotIsDisabled error: HRESULT = HRESULT.
Event ID 109 — AutopilotGetOobeSettingsOverride succeeded: OOBE setting = Message1; state = Message2.
Event ID 110 — AutopilotGetOobeSettingsOverride error: OOBE setting = Message1; HRESULT = HRESULT.
Event ID 111 — AutopilotRetrieveSettings succeeded.
Description
AutopilotRetrieveSettings succeeded.
Message #
Event ID 112 — AutopilotRetrieveSettings error: HRESULT = HRESULT.
Event ID 113 — Autopilot reported the DLL was unloaded while there were Int1 outstanding calls.
Event ID 114 — AutopilotRetrieveSettings was skipped because this version of Windows does not support Azure Active Directory join.
Description
AutopilotRetrieveSettings was skipped because this version of Windows does not support Azure Active Directory join.
Message #
Event ID 115 — Autopilot discovery failed to find a valid MDM.
Event ID 116 — Autopilot Device ESP Domain Controller override was not set.
Description
Autopilot Device ESP Domain Controller override was not set.
Message #
Event ID 117 — Autopilot Device ESP Domain Controller override was set by state UInt1.
Event ID 118 — Autopilot task to detect hardware change started.
Event ID 119 — Autopilot task to detect hardware change finished successfully.
Event ID 120 — Autopilot task to detect hardware change failed.
Event ID 121 — Autopilot task to detect hardware change finished successfully.
Description
Autopilot task to detect hardware change finished successfully. No change was detected.
Message #
Event ID 122 — Autopilot task to detect hardware change finished successfully.
Description
Autopilot task to detect hardware change finished successfully. A change was detected and reported.
Message #
Event ID 123 — Autopilot task to detect hardware change was aborted or cancelled before completion.
Event ID 124 — Autopilot starting to disable task: Message1.
Event ID 125 — Autopilot successfully disabled task: Autopilot_successfully_disabled_task.
Event ID 126 — Autopilot failed to disable task.
Event ID 127 — Autopilot starting to enable task: Message1.
Event ID 128 — Autopilot successfully enabled task: Autopilot_successfully_enabled_task.
Event ID 129 — Autopilot failed to enable task.
Event ID 130 — Autopilot hardware remediation report failed.
Event ID 131 — Autopilot hardware remediation must wait before reporting again.
Event ID 132 — Autopilot hardware remediation failed to process response.
Event ID 133 — Autopilot hardware remediation failed to read cached hardware.
Event ID 134 — Autopilot hardware remediation failed to write cached hardware.
Event ID 150 — AutopilotManager started the MSA service for TPM attestation identity.
Description
AutopilotManager started the MSA service for TPM attestation identity.
Message #
Event ID 151 — AutopilotManager started the TPM maintenance task to update TPM attestation.
Description
AutopilotManager started the TPM maintenance task to update TPM attestation.
Message #
Event ID 152 — AutopilotManager reported TPM maintenance task is complete.
Description
AutopilotManager reported TPM maintenance task is complete.
Message #
Event ID 153 — AutopilotManager reported the state changed from InitialState to UpdateState.
Description
AutopilotManager reported the state changed from InitialState to UpdateState.
Message #
Fields #
| Name | Description |
|---|---|
InitialState UInt32 | — |
UpdateState UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 153,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-09T18:21:06.069716+00:00",
"event_record_id": 29,
"correlation": {
"ActivityID": "C5B1AF6E-270C-4D62-8042-94BEA2A2BA55"
},
"execution": {
"process_id": 4888,
"thread_id": 9948
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"InitialState": 0,
"UpdateState": 1
},
"message": ""
}
Event ID 154 — AutopilotManager failed to start MSA service.
Event ID 155 — AutopilotManager failed to start TPM task.
Event ID 156 — AutopilotManager reported that MSA TPM is not configured for hardware TPM attestation even though the profile indicates it is required.
Description
AutopilotManager reported that MSA TPM is not configured for hardware TPM attestation even though the profile indicates it is required. Autopilot cannot proceed.
Message #
Event ID 157 — AutopilotManager reported that TPM attestation lasted UInt1 microseconds.
Event ID 158 — AutopilotManager reported that TPM enhanced diagnostics logging was enabled for UInt1 providers.
Event ID 160 — AutopilotRetrieveSettings beginning acquisition.
Description
AutopilotRetrieveSettings beginning acquisition.
Message #
Event ID 161 — AutopilotManager retrieve settings succeeded.
Description
AutopilotManager retrieve settings succeeded.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 161,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:27.264631+00:00",
"event_record_id": 8,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 162 — AutopilotManager determined download is not required and the device is not provisioned.
Description
AutopilotManager determined download is not required and the device is not provisioned. Clean or reset the device to change this.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 162,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:31.162906+00:00",
"event_record_id": 14,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 163 — AutopilotManager determined download is not required and the device is already provisioned.
Description
AutopilotManager determined download is not required and the device is already provisioned. Clean or reset the device to change this.
Message #
Event ID 164 — AutopilotManager determined Internet is available to attempt policy download.
Description
AutopilotManager determined Internet is available to attempt policy download.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 164,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:25.048353+00:00",
"event_record_id": 5,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 165 — AutopilotManager determined Internet is not available; policy download will queue when available.
Description
AutopilotManager determined Internet is not available; policy download will queue when available.
Message #
Event ID 166 — AutopilotManager reported Internet is now available.
Description
AutopilotManager reported Internet is now available.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 166,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:25.038727+00:00",
"event_record_id": 4,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 167 — AutopilotManager reported Internet is still not available.
Description
AutopilotManager reported Internet is still not available.
Message #
Event ID 168 — AutopilotManager reported MSA TPM device identity was updated.
Description
AutopilotManager reported MSA TPM device identity was updated.
Message #
Event ID 169 — AutopilotManager set TPM identity confirmed.
Description
AutopilotManager set TPM identity confirmed.
Message #
Event ID 170 — AutopilotManager reported that Autopilot profile download is now complete.
Description
AutopilotManager reported that Autopilot profile download is now complete.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 170,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-09T18:21:06.070120+00:00",
"event_record_id": 30,
"correlation": {
"ActivityID": "C5B1AF6E-270C-4D62-8042-94BEA2A2BA55"
},
"execution": {
"process_id": 4888,
"thread_id": 9948
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 171 — AutopilotManager failed to set TPM identity confirmed.
Event ID 172 — AutopilotManager failed to set Autopilot profile as available.
Event ID 173 — AutopilotManager failed to register for network availability.
Event ID 174 — AutopilotManager failed to register for device identity availability.
Event ID 175 — AutopilotManager failed to register for device identity task update.
Event ID 176 — MSA TPM keystate has been updated.
Event ID 177 — Configuring TPM for attestation.
Event ID 178 — AutopilotManager began device enrollment with internal state Int1.
Event ID 179 — AutopilotManager began device enrollment phase State.
Event ID 180 — AutopilotManager failed during device enrollment phase State.
Event ID 181 — AutopilotManager completed device enrollment phase State.
Event ID 182 — AutopilotManager reported that the retry timer event was set to UInt1 milliseconds.
Event ID 183 — AutopilotManager reported that the retry timer event occurred
Description
AutopilotManager reported that the retry timer event occurred.
Message #
Event ID 184 — AutopilotManager failed to register for MSA keystate update availability.
Event ID 185 — AutopilotManager failed to retrieve settings.
Event ID 186 — AutopilotManager TPM configuration already in progress.
Description
AutopilotManager TPM configuration already in progress.
Message #
Event ID 187 — AutopilotManager TPM configuration occurred before retry timer ready.
Description
AutopilotManager TPM configuration occurred before retry timer ready.
Message #
Event ID 189 — Configuring TPM exceeded maximum number of attempts.
Description
Configuring TPM exceeded maximum number of attempts.
Message #
Event ID 190 — Windows AIK certificate enrollment task was triggered.
Description
Windows AIK certificate enrollment task was triggered.
Message #
Event ID 191 — Windows TPM maintenance task is being skipped since AIK certificate is already present.
Description
Windows TPM maintenance task is being skipped since AIK certificate is already present.
Message #
Event ID 192 — Autopilot device enrollment failed with error HRESULT = HRESULT.
Event ID 193 — Autopilot manager is attempting profile download retry.
Event ID 194 — Autopilot manager will re-attempt the download after UInt1 milliseconds.
Event ID 195 — AutopilotManager began device unenrollment
Description
AutopilotManager began device unenrollment.
Message #
Event ID 196 — AutopilotManager completed device unenrollment.
Event ID 197 — AutopilotManager failed device unenrollment.
Event ID 200 — Windows AIK object could not be loaded.
Event ID 201 — Windows AIK key not found by name.
Description
Windows AIK key not found by name.
Message #
Event ID 202 — Windows AIK certificate download failed.
Event ID 203 — Windows AIK alternative load failed.
Event ID 204 — Windows AIK certificate request did not result in a new certificate.
Description
Windows AIK certificate request did not result in a new certificate.
Message #
Event ID 205 — Windows AIK certificate request succeeded and a new certificate is available.
Description
Windows AIK certificate request succeeded and a new certificate is available.
Message #
Event ID 206 — Windows AIK key could not be opened.
Event ID 207 — Windows AIK key failed certificate request.
Event ID 208 — Windows EK certificate is present.
Description
Windows EK certificate is present.
Message #
Event ID 209 — Windows EK certificate is not present.
Description
Windows EK certificate is not present.
Message #
Event ID 210 — Windows AIK key was found even though the Windows EK certificate is not present.
Description
Windows AIK key was found even though the Windows EK certificate is not present. Attempting to re-initialize the TPM task.
Message #
Event ID 211 — AutopilotManager reported that a TPM was required but the TPM failed an attestation capability check.
Event ID 212 — AutopilotManager reported the TPM returned the following for known vulnerabilities: HRESULT = HRESULT.
Event ID 213 — AutopilotManager reported the TPM returned the following for Key attestation capability: HRESULT = HRESULT.
Event ID 250 — AutopilotManager started AIK certificate acquisition task.
Description
AutopilotManager started AIK certificate acquisition task.
Message #
Event ID 251 — AutopilotManager reported AIK certificate acquisition task returned HRESULT = Elapsed_time.
Event ID 252 — AutopilotManager reported AIK key was located.
Description
AutopilotManager reported AIK key was located.
Message #
Event ID 253 — AutopilotManager reported AIK certificate was located.
Description
AutopilotManager reported AIK certificate was located.
Message #
Event ID 254 — AutopilotManager reported AIK certificate was not located.
Description
AutopilotManager reported AIK certificate was not located.
Message #
Event ID 285 — AutopilotManager is determining whether device has internet access.
Description
AutopilotManager is determining whether device has internet access.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 285,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:24.908119+00:00",
"event_record_id": 3,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 286 — AutopilotManager is determining Autopilot profile availability.
Description
AutopilotManager is determining Autopilot profile availability.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 286,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:31.162893+00:00",
"event_record_id": 13,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 287 — Tracking resource type Message1.
Event ID 288 — Tracking resource type Message1.
Event ID 289 — Tracking resource type Message1.
Event ID 290 — Tracking resource type Message1.
Event ID 291 — Tracking resource type Message1.
Event ID 292 — Tracking resource type Message1.
Event ID 293 — Tracking resource type Message1.
Event ID 294 — Tracking resource type Message1.
Event ID 295 — Tracking resource type Message1.
Event ID 296 — Tracking resource type Message1.
Event ID 297 — Tracking resource type Message1.
Event ID 298 — Tracking resource type Message1.
Event ID 299 — Tracking resource type Message1.
Event ID 300 — AutopilotManager device enrollment reported an initialization failure.
Event ID 301 — AutopilotManager device enrollment reported a blocking failure.
Event ID 302 — AutopilotManager device enrollment failed during stage State with error HRESULT.
Event ID 303 — AutopilotManager device enrollment succeeded.
Event ID 310 — Autopilot configuration file path: Autopilot_configuration_file_path.
Event ID 311 — Failed to load Autopilot configuration file, HRESULT = HRESULT.
Event ID 312 — Failed to parse Autopilot configuration file, HRESULT = HRESULT.
Event ID 313 — Invalid ZtdCorrelationId found in Autopilot configuration file, HRESULT = HRESULT.
Event ID 314 — AutopilotManager reported that the Autopilot profile data could not be downloaded.
Description
AutopilotManager reported that the Autopilot profile data could not be downloaded. Any Autopilot settings will not be used and the device will not be managed.
Message #
Event ID 315 — AutopilotManager failed to record the setting for Autopilot device not managed, HRESULT = HRESULT.
Event ID 316 — AutopilotSync: Starting sync sessions for SyncType: UInt1.
Event ID 317 — AutopilotSync: Ending sync sessions for SyncType: UInt1.
Event ID 318 — AutopilotSync: Attempted sync session.
Event ID 319 — AutopilotSync: Skipped sync session.
Event ID 320 — AutopilotSync: Using user SID: AutopilotSync_Using_user_SID.
Event ID 321 — AutopilotSync: Current sync session.
Event ID 350 — Autopilot for Surface Hub encountered bad override data.
Event ID 351 — Autopilot for Surface Hub override succeeded.
Event ID 352 — Autopilot for Surface Hub failed to configure properties.
Event ID 353 — Autopilot for Surface Hub failed to apply properties.
Event ID 354 — Autopilot for Surface Hub applied properties successfully
Description
Autopilot for Surface Hub applied properties successfully.
Message #
Event ID 355 — Autopilot for Surface Hub failed to validate a property.
Event ID 356 — Autopilot for Surface Hub failed to execute the Csp successfully.
Event ID 357 — Autopilot for Surface Hub validated and applied properties successfully
Description
Autopilot for Surface Hub validated and applied properties successfully.
Message #
Event ID 358 — Autopilot for Surface Hub failed to apply the device account successfully.
Event ID 400 — Autopilot Initial Provisioning reported a change in connection status.
Event ID 401 — Autopilot Initial Provisioning heartbeat occurred.
Description
Autopilot Initial Provisioning heartbeat occurred.
Message #
Fields #
| Name | Description |
|---|---|
Host_result HexInt32 | — |
Agent_result HexInt32 | — |
Overall_result HexInt32 | — |
Host_failure_count UInt32 | — |
Agent_failure_count UInt32 | — |
DisplayPageResult HexInt32 | — |
AgentResult HexInt32 | — |
OverallResult HexInt32 | — |
ConsecutiveHostFailures UInt32 | — |
ConsecutiveAgentFailures UInt32 | — |
Event ID 402 — Autopilot Initial Provisioning detected a network state change.
Event ID 403 — Autopilot Provisioning change.
Description
Autopilot Provisioning change. Session Id: Autopilot_Provisioning_change_Session_Id, sequence number: sequence_number.
Message #
Fields #
| Name | Description |
|---|---|
Autopilot_Provisioning_change_Session_Id UnicodeString | Autopilot Provisioning change. Session Id. |
Source UnicodeString | — |
Details UnicodeString | — |
sequence_number Int32 | — |
Message1 UnicodeString | — |
Message2 UnicodeString | — |
Message3 UnicodeString | — |
Int1 Int32 | — |
Event ID 404 — Autopilot Provisioning change started.
Event ID 405 — Autopilot Provisioning change succeeded.
Event ID 406 — Autopilot Provisioning change failed.
Event ID 407 — Autopilot Provisioning change failed with unspecified error.
Event ID 408 — Autopilot Provisioning reported a warning occurred.
Event ID 409 — Unexpected error: device preparation page settings are not configured or are invalid.
Event ID 410 — Device preparation page settings were loaded successfully.
Description
Device preparation page settings were loaded successfully.
Message #
Event ID 411 — Unexpected error: a device preparation page setting value could not be loaded/converted.
Event ID 412 — Agent download completed.
Event ID 413 — Agent download notification complete.
Event ID 414 — Agent download notification handler changed.
Description
Agent download notification handler changed. Callback was added.
Message #
Event ID 415 — Agent download notification handler changed.
Description
Agent download notification handler changed. Callback was removed.
Message #
Event ID 416 — Agent download was triggered.
Description
Agent download was triggered.
Message #
Event ID 417 — A duplicate deployment workload with this id already exists.
Event ID 418 — A duplicate deployment workload batch with this id already exists.
Event ID 419 — Runtime activation of a device preparation class failed due to invalid mode.
Event ID 500 — Invalid data specified in Autopilot policy override configuration.
Event ID 501 — AutopilotManager failed to load Json for HRESULT.
Event ID 502 — AutopilotManager failed to clear for HRESULT.
Event ID 503 — AutopilotManager failed to delete Json for HRESULT.
Event ID 504 — AutopilotManager deleted configuration file Message1.
Event ID 505 — AutopilotManager loaded configuration file Message1.
Description
AutopilotManager loaded configuration file Message1.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 505,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:02.141371+00:00",
"event_record_id": 17,
"correlation": {
"ActivityID": "78324F2B-4F77-4BDB-AD31-1593143E4213"
},
"execution": {
"process_id": 4888,
"thread_id": 9948
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "AutopilotDDSZTDFile.json"
},
"message": ""
}
Event ID 506 — AutopilotManager failed to expand path for Message1.
Event ID 507 — AutopilotManager explictly disabled TPM required due to registry setting.
Description
AutopilotManager explictly disabled TPM required due to registry setting.
Message #
Event ID 508 — AutopilotManager explictly enabled TPM required due to registry setting.
Description
AutopilotManager explictly enabled TPM required due to registry setting.
Message #
Event ID 509 — AutopilotManager enabled TPM requirement due to WhiteGlove policy value UInt1.
Event ID 700 — Autopilot downloader failed to load override registsry data for Message1.
Event ID 701 — Autopilot downloader did not save new profile information because the new profile was empty.
Description
Autopilot downloader did not save new profile information because the new profile was empty.
Message #
Event ID 702 — Autopilot downloader saved the new profile to Message1.
Description
Autopilot downloader saved the new profile to Message1.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 702,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:27.256412+00:00",
"event_record_id": 7,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6520
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "C:\\Windows\\ServiceState\\wmansvc\\AutopilotDDSZTDFile.json"
},
"message": ""
}
Event ID 703 — Autopilot downloader retrieved a new profile for Message1.
Event ID 704 — Autopilot downloader retrieved an empty profile for Message1.
Description
Autopilot downloader retrieved an empty profile for Message1.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 704,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:27.255925+00:00",
"event_record_id": 6,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6520
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "DdsZtdPolicyManager"
},
"message": ""
}
Event ID 705 — Autopilot downloader cleared the local profile for Message1.
Description
Autopilot downloader cleared the local profile for Message1.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 705,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:24.392812+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "DdsZtdPolicyManager"
},
"message": ""
}
Event ID 706 — Autopilot downloader failed to download profile for HRESULT.
Event ID 707 — Autopilot downloader failed to download profile for HRESULT.
Event ID 708 — Autopilot downloader failed to extract additional error details from response.
Event ID 709 — Autopilot failed to download data.
Event ID 710 — Autopilot failed to acquire a device ticket for target URL Message1.
Event ID 711 — Autopilot downloader failed to parse target URL.
Event ID 712 — Autopilot downloader failed to convert time Message1.
Event ID 713 — Autopilot downloader will use MSA Pre-production environment.
Description
Autopilot downloader will use MSA Pre-production environment. This will result in Autopilot failures if production device identities were used.
Message #
Event ID 714 — Autopilot downloader reported a failure acquiring the MSA device ticket.
Description
Autopilot downloader reported a failure acquiring the MSA device ticket. This most likely occurred because MSA and CXH environments do not match (production versus PPE).
Message #
Event ID 750 — Autopilot downloader reported a failure acquiring the MSA device ticket due to certificate errors.
Description
Autopilot downloader reported a failure acquiring the MSA device ticket due to certificate errors. This may be caused by the wrong clock time on the machine so a forced time sync will be attempted.
Message #
Event ID 751 — Autopilot downloader reported time sync succeeded.
Description
Autopilot downloader reported time sync succeeded.
Message #
Event ID 752 — Autopilot downloader reported time sync failed with error = HRESULT.
Event ID 753 — Autopilot downloader reported that the machine clock is too far off the server time and a forced time sync will be attempted.
Event ID 1000 — Management service starting.
Description
Management service starting.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1000,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:01.066409+00:00",
"event_record_id": 14,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 4516
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 1001 — Management service started.
Description
Management service started.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1001,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:02.125001+00:00",
"event_record_id": 16,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 4516
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 1002 — Management service failed to start.
Event ID 1003 — Management service failed to register.
Description
Management service failed to register.
Message #
Event ID 1004 — Management service shutdown.
Description
Management service shutdown.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1004,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:21.532518+00:00",
"event_record_id": 18,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 4516
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 1005 — Management service WIL error was reported.
Event ID 1006 — Management service call Message1 is deprecated!
Event ID 1007 — Management service cleared the local Autopilot cached state.
Description
Management service cleared the local Autopilot cached state.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1007,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2025-12-31T19:33:24.564324+00:00",
"event_record_id": 6,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 1008 — Management service failed to clear the local Autopilot cached state.
Event ID 1009 — Management InProc Objects WIL error was reported.
Event ID 1010 — Autopilot.
Event ID 1100 — Management service will use Message1 for persisted storage.
Description
Management service will use Message1 for persisted storage.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1100,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:01.074751+00:00",
"event_record_id": 15,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 4516
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "C:\\Windows\\ServiceState\\wmansvc"
},
"message": ""
}
Event ID 1101 — Management service did not find Message1.
Description
Management service did not find Message1. Attempting to create it.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1101,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2025-12-31T19:33:20.250928+00:00",
"event_record_id": 3,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6792
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "C:\\Windows\\ServiceState\\wmansvc"
},
"message": ""
}
Event ID 1102 — Management service created Message1.
Description
Management service created Message1.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1102,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2025-12-31T19:33:20.251448+00:00",
"event_record_id": 4,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6792
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "C:\\Windows\\ServiceState\\wmansvc"
},
"message": ""
}
Event ID 1103 — Management service found ProcMon.
Description
Management service found ProcMon.exe for startup profiling.
Message #
Event ID 1104 — Management service determined ProcMon.
Description
Management service determined ProcMon.exe startup profiling is not enabled in the registry.
Message #
Event ID 1105 — Management service determined ProcMon.
Description
Management service determined ProcMon.exe startup profiling is enabled in the registry.
Message #
Event ID 1106 — Management service is beginning ProcMon.
Description
Management service is beginning ProcMon.exe startup profiling.
Message #
Event ID 1107 — Management service is began ProcMon.
Description
Management service is began ProcMon.exe startup profiling.
Message #
Event ID 1108 — Management service is stopping ProcMon.
Description
Management service is stopping ProcMon.exe startup profiling.
Message #
Event ID 1109 — Management service has stopped ProcMon.
Description
Management service has stopped ProcMon.exe startup profiling.
Message #
Event ID 1500 — [Unit Tests] This is a test event string.
Description
[Unit Tests] This is a test event string.
Message #
Event ID 1501 — [Unit Tests] This is a test CXH event string.
Description
[Unit Tests] This is a test CXH event string.
Message #
Event ID 1502 — [Unit Tests] This is a test Resource event string.
Description
[Unit Tests] This is a test Resource event string.
Message #
Event ID 1503 — Failed to export logs for ETW channel 'Message1'.
Event ID 1504 — ETW decoder failed to read next block of events.
Description
ETW decoder failed to read next block of events.
Message #
Event ID 1505 — Abstraction of exported ETW record failed.
Description
Abstraction of exported ETW record failed.
Message #
Event ID 1506 — An error occurred while extracting the registry value for diagnostic data 'Message1'.
Event ID 1507 — Expected channel 'Message1' could not be found in the EtwProcessingData JSON object.
Event ID 1508 — Expected EtwProcessingData entry corresponding to event 'Message1' could not be found.
Event ID 1509 — Expected diagnostic data 'Message1' could not be found.
Event ID 1510 — CXH event was malformed.
Event ID 1511 — Expected required diagnostic data 'Message1' from the extracted data list was missing some expected data.
Event ID 1512 — The API executed all actions successfully.
Description
The API executed all actions successfully.
Message #
Event ID 1513 — The API encountered an error at state 'FailedApiState'.
Event ID 1514 — The expected key 'Message1' was not found in the 'Message2' map.
Event ID 1515 — The expected diagnostic data 'Message1' was missing.
Event ID 1516 — Resource event was malformed.
Event ID 1517 — CXH event was missing data.
Event ID 1518 — The API is entering the 'Message1' state.
Event ID 1519 — The API completed the 'Message1' state successfully.
Event ID 1520 — The API successfully retrieved the serialized JSON from the 'Message1' file.
Event ID 1521 — The API successfully deserialized the 'Message1' file JSON string.
Event ID 1522 — The API successfully aggregated the source data.
Description
The API successfully aggregated the source data.
Message #
Event ID 1523 — The 'Message1' concurrent worker has begun.
Event ID 1524 — The 'Message1' concurrent worker completed successfully.
Event ID 1525 — An exception occurred while processing diagnostic data.
Event ID 1526 — Diagnostic extraction failed.
Event ID 1527 — The localized string for 'Message1' could not be loaded.
Event ID 1700 — MDM Alert sync session: FeatureName: MDM_Alert_sync_session_FeatureName, IsCompleted: IsCompleted, SessionState: SessionState, SyncSessionId: SyncSessionId, EnrollmentId: EnrollmentId.
Description
MDM Alert sync session: FeatureName: MDM_Alert_sync_session_FeatureName, IsCompleted: IsCompleted, SessionState: SessionState, SyncSessionId: SyncSessionId, EnrollmentId: EnrollmentId.
Message #
Fields #
| Name | Description |
|---|---|
MDM_Alert_sync_session_FeatureName UnicodeString | MDM Alert sync session: FeatureName. |
IsCompleted UInt32 | — |
SessionState UInt32 | — |
SyncSessionId UnicodeString | — |
EnrollmentId UnicodeString | — |
Message1 UnicodeString | — |
Uint1 UInt32 | — |
Uint2 UInt32 | — |
Message2 UnicodeString | — |
Message3 UnicodeString | — |