Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Description

Binary data sent from PCA Diagnostic Module to PCA service for processing. It is not meant to be human readable.

Message #

Binary data sent from PCA Diagnostic Module to PCA service for processing. It is not meant to be human readable.

Fields #

Description

Binary data sent from PCA Diagnostic Module to PCA service for processing. It is not meant to be human readable.

Message #

Binary data sent from PCA Diagnostic Module to PCA service for processing. It is not meant to be human readable.

Fields #

Description

PCA has finished monitoring an application: ExePath.

Message #

PCA has finished monitoring an application: %1

The problems detected code is: %2

If this number is not 0, PCA observed some indications of compatibility problems.

For this application, the following dialog type was shown:%3

If this number is not 0, an actual dialog was shown offering possible fixes to suspected problems.

Fields #

Message #

Exe: %1

ResolverName: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Program-Compatibility-Assistant",
    "guid": "4CB314DF-C11F-47D7-9C04-65FB0051561B",
    "event_source_name": "",
    "event_id": 17,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-06T02:02:45.055790+00:00",
    "event_record_id": 42,
    "correlation": {},
    "execution": {
      "process_id": 5756,
      "thread_id": 8424
    },
    "channel": "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "ResolverFiredEvent": {
      "ExePath": "C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe",
      "ResolverName": "DetectorShim_KernelDriver"
    }
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Message #

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
Compatibility layer: %6

Fields #

Description

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Message #

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
Compatibility layer: %6
Deprecated component: %7

Fields #

Message #

The Program Compatibility Assistant was invoked due to an unsigned driver install. This version of Windows requires all drivers to have a valid digital signature. Information about the driver is below.

Driver: %1
Service: %2
Publisher: %3
Location: %4
Version: %5

This driver is unavailable and the program that uses this driver might not work correctly.

Fields #

Description

PCA Service startup begin.

Message #

PCA Service startup begin.

Description

PCA Service startup finished.

Message #

PCA Service startup finished.

Description

PCA Process Monitor begin.

Message #

PCA Process Monitor begin.

Description

PCA Process Monitor finished.

Message #

PCA Process Monitor finished.

Description

PCA Service initialization begin.

Message #

PCA Service initialization begin.

Description

PCA Service initialization finished.

Message #

PCA Service initialization finished.

Description

PCA Service initialization begin.

Message #

PCA Service initialization begin.

Description

PCA Service initialization finished.

Message #

PCA Service initialization finished.

Description

The Program Compatibility Assistant service was stopped successfully.

Message #

The Program Compatibility Assistant service was stopped successfully.

Description

The Program Compatibility Assistant service started successfully.

Message #

The Program Compatibility Assistant service started successfully.

Description

The Program Compatibility Assistant service failed to initialize.

Message #

The Program Compatibility Assistant service failed to initialize.

Description

The Program Compatibility Assistant service failed to start.

Message #

The Program Compatibility Assistant service failed to start.

Description

The Program Compatibility Assistant service failed to stop.

Message #

The Program Compatibility Assistant service failed to stop.

Description

The Program Compatibility Assistant service failed to perform the phase two initialization.

Message #

The Program Compatibility Assistant service failed to perform the phase two initialization.

Description

The Program Compatibility Assistant service successfully performed phase two initialization.

Message #

The Program Compatibility Assistant service successfully performed phase two initialization.

Description

Notified PCA service of status icon registration.

Message #

Notified PCA service of status icon registration.

Description

PCA Trigger event:PCA_Trigger_event.

Message #

PCA Trigger event:%1

Fields #

Description

PCA Trigger event:TriggerID.

Message #

PCA Trigger event:%1

Fields #

Description

Exe: AppIdApplicationID.

Message #

Exe: AppId%1

Uptime %2

Fields #