Microsoft-Windows-MUI
28 events across 4 channels
Event ID 2000 — MUI notify operation failed with status code Status.
Description
MUI notify operation failed with status code Status. No callbacks were invoked.
Message #
Fields #
| Name | Description |
|---|---|
Status UInt32 | — NTSTATUS reference |
Event ID 2001 — MUI Callback failed for file FileName because it can not be loaded.
Event ID 2002 — MUI Callback failed for file FileName registered as type Type because the function FunctionName does not exist in the dll.
Event ID 2003 — MUI Callback failed for file FileName because it is not signed by Microsoft.
Event ID 2004 — MUI Callback file FileName cannot be found.
Event ID 2006 — Wow redirection could not be disabled.
Description
Wow redirection could not be disabled. New resource cache will not be built.
Message #
Event ID 2007 — Resource cache cannot be opened in writable mode.
Description
Resource cache cannot be opened in writable mode. New resource cache will not be built.
Message #
Event ID 2008 — Live resource cache could not be disabled.
Description
Live resource cache could not be disabled.
Message #
Event ID 2009 — Unable to retrieve language settings from MUI API.
Description
Unable to retrieve language settings from MUI API. New resource cache will not be built.
Message #
Event ID 2010 — Unable to parse the cacheable file list or write to the resource cache manifest.
Message #
Event ID 2011 — Changes made to resource cache manifest cannot be written to disk.
Description
Changes made to resource cache manifest cannot be written to disk. New resource cache will not be built.
Message #
Event ID 2012 — New resource cache could not be built due to internal error: ErrorCode.
Event ID 2013 — Newly built resource cache could not be installed on the system.
Description
Newly built resource cache could not be installed on the system.
Message #
Event ID 2014 — Resource cache manifest could not be created.
Description
Resource cache manifest could not be created. New resource cache will not be built.
Message #
Event ID 3000 — MUI notification for UI Language change has been invoked with flags set to Flags and the new languages set to NewLanguage and the previous languages set to PrevLanguage.
#Description
MUI notification for UI Language change has been invoked with flags set to Flags and the new languages set to NewLanguage and the previous languages set to PrevLanguage. The extended flags is set to ExtendedFlag.
Message #
Fields #
| Name | Description |
|---|---|
Flags UInt32 | — |
NewLanguage UnicodeString | — |
PrevLanguage UnicodeString | — |
ExtendedFlag UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-MUI",
"guid": "A8A1F2F6-A13A-45E9-B1FE-3419569E5EF2",
"event_source_name": "",
"event_id": 3000,
"version": 0,
"level": 4,
"task": 30,
"opcode": 30,
"keywords": 9223372036854775808,
"time_created": "2023-11-06T06:25:37.341209+00:00",
"event_record_id": 21,
"correlation": {},
"execution": {
"process_id": 1424,
"thread_id": 1552
},
"channel": "Microsoft-Windows-MUI/Operational",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Flags": 1,
"NewLanguage": "en-US",
"PrevLanguage": "en-US",
"ExtendedFlag": 0
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 3002 — MUI notification callback API FunctionName in FileName returned with code ReturnValue.
#Description
MUI notification callback API FunctionName in FileName returned with code ReturnValue.
Message #
Fields #
| Name | Description |
|---|---|
FileName UnicodeString | — |
FunctionName AnsiString | — |
ReturnValue UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-MUI",
"guid": "A8A1F2F6-A13A-45E9-B1FE-3419569E5EF2",
"event_source_name": "",
"event_id": 3002,
"version": 0,
"level": 4,
"task": 30,
"opcode": 31,
"keywords": 9223372036854775808,
"time_created": "2023-11-06T06:25:38.231122+00:00",
"event_record_id": 28,
"correlation": {},
"execution": {
"process_id": 1424,
"thread_id": 1552
},
"channel": "Microsoft-Windows-MUI/Operational",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"FileName": "TimeDateMUICallback.dll",
"FunctionName": "",
"ReturnValue": 1299074816
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 3003 — MUI resource cache builder has been called with the following parameters: Parameter.
#Description
MUI resource cache builder has been called with the following parameters: Parameter.
Message #
Fields #
| Name | Description |
|---|---|
Parameter UnicodeString | MUI resource cache builder has been called with the following parameters. |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-MUI",
"guid": "A8A1F2F6-A13A-45E9-B1FE-3419569E5EF2",
"event_source_name": "",
"event_id": 3003,
"version": 0,
"level": 4,
"task": 31,
"opcode": 30,
"keywords": 9223372036854775808,
"time_created": "2023-11-06T06:25:38.190967+00:00",
"event_record_id": 27,
"correlation": {},
"execution": {
"process_id": 1568,
"thread_id": 1572
},
"channel": "Microsoft-Windows-MUI/Operational",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Parameter": "-s "
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 3004 — MUI resource cache manifest entry for file and_Priority has been updated.
Event ID 3007 — New resource cache built and installed on system.
Event ID 3012 — Resource file FileName will not be cached since it is not used frequently in the system.
Event ID 3013 — The system is constrained in RAM, total disk space or free disk space, so the MUI resource cache will not be maintained.
Description
The system is constrained in RAM, total disk space or free disk space, so the MUI resource cache will not be maintained.
Message #
Event ID 4000 — Unable to parse configuration parameters.
Description
Unable to parse configuration parameters. The configuration parameters will be ignored.