detection.wiki

Microsoft-Windows-OfflineFiles

31 events across 3 channels

Event IDTitleChannel
1The Offline Files service started successfully.Operational
2The Offline Files service is terminating.Operational
3The Offline Files service is waiting for all running tasks to complete.Operational
4The Offline Files service has terminated.Operational
5The Offline Files service received a STOP or SHUTDOWN control from the Service …Operational
6The Offline Files driver.System
7User logon detected.Operational
8User logoff detected.Operational
9Path disconnected.Operational
10Path reconnected.Operational
11Offline Files configuration is being controlled by Group Policy.Operational
12Offline Files configuration is being controlled by WMI configuration classes …Operational
1000Background agent failed startup, error = Text.Operational
1001Background Synchronization failed on Path.Operational
1002Background Synchronization executed successfully.Operational
1003Background Synchronization has started on Path as client has not synced for …Operational
1004Path Path transitioned to slow link with latency = Latency and bandwidth = …Operational
1005Path Path transitioned to online with latency = Latency.Operational
1006Background Synchronization failed for FailedFileCount files on Path.Operational
1007Path Path transitioned to slow link mode so the user will work offline with …Operational
1008Path Path failed to transition to slow link mode due to an open handle on …Operational
1009Path Path failed to transition to slow link mode due to an open handle.Operational
2000Sync info for Path Only the server copy exists.SyncLog
2001Sync info for Path Only the client copy exists.SyncLog
2002Sync info for Path Both client and server copies exist.SyncLog
2003Sync info for Path Server copy exists, client copy deleted.SyncLog
2004Sync info for Path Server copy exists, client copy replaced then deleted.SyncLog
2005Sync succeeded.SyncLog
2006Sync failed.SyncLog
2010Creation of new excluded file type.Operational
2011Rename of file SourcePath to file TargetPath was blocked.Operational

Event ID 1 — The Offline Files service started successfully.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

The Offline Files service started successfully.

Message #

The Offline Files service started successfully.

Event ID 2 — The Offline Files service is terminating.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

The Offline Files service is terminating.

Message #

The Offline Files service is terminating.

Event ID 3 — The Offline Files service is waiting for all running tasks to complete.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

The Offline Files service is waiting for all running tasks to complete.

Message #

The Offline Files service is waiting for all running tasks to complete.

Event ID 4 — The Offline Files service has terminated.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

The Offline Files service has terminated.

Message #

The Offline Files service has terminated.

Event ID 5 — The Offline Files service received a STOP or SHUTDOWN control from the Service Control Manager.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

The Offline Files service received a STOP or SHUTDOWN control from the Service Control Manager. The service will now stop.

Message #

The Offline Files service received a STOP or SHUTDOWN control from the Service Control Manager.  The service will now stop.

Event ID 6 — The Offline Files driver.

Provider
Microsoft-Windows-OfflineFiles
Channel
System
Opcode
Info

Description

The Offline Files driver (csc.sys) is not running.

Message #

The Offline Files driver (csc.sys) is not running.

Event ID 7 — User logon detected.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

User logon detected.

Message #

User logon detected
Account: %1
Session: %2

Fields #

NameDescription
Account UnicodeString—
Session UInt32—

Event ID 8 — User logoff detected.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

User logoff detected.

Message #

User logoff detected
Account: %1
Session: %2

Fields #

NameDescription
Account UnicodeString—
Session UInt32—

Event ID 9 — Path disconnected.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Path disconnected.

Message #

Path disconnected.
%1

Fields #

NameDescription
Path UnicodeString—

Event ID 10 — Path reconnected.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Path reconnected.

Message #

Path reconnected.
%1

Fields #

NameDescription
Path UnicodeString—

Event ID 11 — Offline Files configuration is being controlled by Group Policy.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Offline Files configuration is being controlled by Group Policy.

Message #

Offline Files configuration is being controlled by Group Policy.

Event ID 12 — Offline Files configuration is being controlled by WMI configuration classes Win32_OfflineFilesUserConfiguration and Win32_OfflineFilesMachineConfi...

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Offline Files configuration is being controlled by WMI configuration classes Win32_OfflineFilesUserConfiguration and Win32_OfflineFilesMachineConfiguration.

Message #

Offline Files configuration is being controlled by WMI configuration classes Win32_OfflineFilesUserConfiguration and Win32_OfflineFilesMachineConfiguration.

Event ID 1000 — Background agent failed startup, error = Text.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Background agent failed startup, error = Text.

Message #

Background agent failed startup, error = %1

Fields #

NameDescription
Text UnicodeString—

Event ID 1001 — Background Synchronization failed on Path.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Background Synchronization failed on.

Message #

Background Synchronization failed on 

%1

Fields #

NameDescription
Path UnicodeString—
ResultCode UnicodeString—
Result UnicodeString—

Event ID 1002 — Background Synchronization executed successfully.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Background Synchronization executed successfully.

Message #

Background Synchronization executed successfully.

Event ID 1003 — Background Synchronization has started on Path as client has not synced for MinutesSinceLastSync minutes.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Background Synchronization has started on.

Message #

Background Synchronization has started on 

%1

 as client has not synced for %2 minutes.

Fields #

NameDescription
Path UnicodeString—
MinutesSinceLastSync UInt32—

Event ID 1004 — Path Path transitioned to slow link with latency = Latency and bandwidth = Bandwidth.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Path Path transitioned to slow link with latency = Latency and bandwidth = Bandwidth.

Message #

Path %1 transitioned to slow link with latency = %2 and bandwidth = %3

Fields #

NameDescription
Path UnicodeString—
Latency UInt64—
Bandwidth UInt64—

Event ID 1005 — Path Path transitioned to online with latency = Latency.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Path Path transitioned to online with latency = Latency.

Message #

Path %1 transitioned to online with latency = %2

Fields #

NameDescription
Path UnicodeString—
Latency UInt64—

Event ID 1006 — Background Synchronization failed for FailedFileCount files on Path.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Background Synchronization failed for FailedFileCount files on.

Message #

Background Synchronization failed for %2 files on 

%1

Fields #

NameDescription
Path UnicodeString—
FailedFileCount UInt32—

Event ID 1007 — Path Path transitioned to slow link mode so the user will work offline with background synchronization of the data to the file server.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Message #

Path %1 transitioned to slow link mode so the user will work offline with background synchronization of the data to the file server. The administrator has configured this path to work offline regardless of the network performance.

Fields #

NameDescription
Path UnicodeString—

Event ID 1008 — Path Path failed to transition to slow link mode due to an open handle on FileName.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Path Path failed to transition to slow link mode due to an open handle on FileName.

Message #

Path %1 failed to transition to slow link mode due to an open handle on %2.

Fields #

NameDescription
Path UnicodeString—
FileName UnicodeString—

Event ID 1009 — Path Path failed to transition to slow link mode due to an open handle.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Path Path failed to transition to slow link mode due to an open handle.

Message #

Path %1 failed to transition to slow link mode due to an open handle.

Fields #

NameDescription
Path UnicodeString—

Event ID 2000 — Sync info for Path Only the server copy exists.

Provider
Microsoft-Windows-OfflineFiles
Channel
SyncLog
Opcode
Info

Description

Sync info for Path.

Message #

Sync info for %1
Only the server copy exists.
%10
See details for more information.

Fields #

NameDescription
Path UnicodeString—
ServerIsDir Boolean—
ClientDeleted Boolean—
ServerChanged Boolean—
ServerLastWriteTime FILETIME—
ServerChangeTime FILETIME—
ServerAttributes UInt32—
ServerSize UInt64—
SyncState UInt32—
SyncStateText UnicodeString—

Event ID 2001 — Sync info for Path Only the client copy exists.

Provider
Microsoft-Windows-OfflineFiles
Channel
SyncLog
Opcode
Info

Description

Sync info for Path.

Message #

Sync info for %1
Only the client copy exists.
%12
See details for more information.

Fields #

NameDescription
Path UnicodeString—
ClientIsDir Boolean—
ClientChanged Boolean—
ClientIsSparse Boolean—
ClientCreatedOffline Boolean—
ClientDeletedOffline Boolean—
ClientLastWriteTime FILETIME—
ClientChangeTime FILETIME—
ClientAttributes UInt32—
ClientSize UInt64—
ServerDeleted Boolean—
SyncState UInt32—
SyncStateText UnicodeString—

Event ID 2002 — Sync info for Path Both client and server copies exist.

Provider
Microsoft-Windows-OfflineFiles
Channel
SyncLog
Opcode
Info

Description

Sync info for Path.

Message #

Sync info for %1
Both client and server copies exist.
%17
See details for more information.

Fields #

NameDescription
Path UnicodeString—
ClientIsDir Boolean—
ClientChanged Boolean—
ClientIsSparse Boolean—
ClientCreatedOffline Boolean—
ClientLastWriteTime FILETIME—
ClientChangeTime FILETIME—
ClientAttributes UInt32—
ClientSize UInt64—
ServerIsDir Boolean—
ServerChanged Boolean—
ServerLastWriteTime FILETIME—
ServerChangeTime FILETIME—
ServerAttributes UInt32—
ServerSize UInt64—
SyncState UInt32—
SyncStateText UnicodeString—

Event ID 2003 — Sync info for Path Server copy exists, client copy deleted.

Provider
Microsoft-Windows-OfflineFiles
Channel
SyncLog
Opcode
Info

Description

Sync info for Path.

Message #

Sync info for %1
Server copy exists, client copy deleted.
%13
See details for more information.

Fields #

NameDescription
Path UnicodeString—
ClientIsDir Boolean—
ClientChanged Boolean—
ClientIsSparse Boolean—
ClientCreatedOffline Boolean—
ServerIsDir Boolean—
ServerChanged Boolean—
ServerLastWriteTime FILETIME—
ServerChangeTime FILETIME—
ServerAttributes UInt32—
ServerSize UInt64—
SyncState UInt32—
SyncStateText UnicodeString—

Event ID 2004 — Sync info for Path Server copy exists, client copy replaced then deleted.

Provider
Microsoft-Windows-OfflineFiles
Channel
SyncLog
Opcode
Info

Description

Sync info for Path.

Message #

Sync info for %1
Server copy exists, client copy replaced then deleted.
%10\
See details for more information.

Fields #

NameDescription
Path UnicodeString—
ClientIsDir Boolean—
ServerIsDir Boolean—
ServerChanged Boolean—
ServerLastWriteTime FILETIME—
ServerChangeTime FILETIME—
ServerAttributes UInt32—
ServerSize UInt64—
SyncState UInt32—
SyncStateText UnicodeString—

Event ID 2005 — Sync succeeded.

Provider
Microsoft-Windows-OfflineFiles
Channel
SyncLog
Opcode
Info

Description

Sync succeeded.

Message #

Sync succeeded.

%1

Operation: %2

Fields #

NameDescription
Operation UnicodeString—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
Path UnicodeString—

Event ID 2006 — Sync failed.

Provider
Microsoft-Windows-OfflineFiles
Channel
SyncLog
Opcode
Info

Description

Sync failed.

Message #

Sync failed.

%1

Operation: %2
Result: %4

Fields #

NameDescription
Operation UnicodeString—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
Result UnicodeString—
Path UnicodeString—
ResultCode UnicodeString—

Event ID 2010 — Creation of new excluded file type.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Creation of new excluded file type.

Message #

Creation of new excluded file type 
%1 was blocked.

Fields #

NameDescription
Path UnicodeString—

Event ID 2011 — Rename of file SourcePath to file TargetPath was blocked.

Provider
Microsoft-Windows-OfflineFiles
Channel
Operational
Opcode
Info

Description

Rename of file SourcePath to file TargetPath was blocked. The source and/or target file name is an excluded file type.

Message #

Rename of file %1 to file %2 was blocked. The source and/or target file name is an excluded file type.

Fields #

NameDescription
SourcePath UnicodeString—
TargetPath UnicodeString—